Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links

CAO 7.4CVE-2026-45245 · GHSA-2r69-qgv3-hr65 · Công bố 18/05/2026 · cập nhật 14/10/2026

Tóm tắt nhanh

CVE-2026-45245 là lỗ hổng mức CAO (CVSS 7.4) ảnh hưởng summarize (steipete), @steipete/summarize.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.33%, cao hơn 26.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.15.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
summarize steipete	`< 0.15.1`	`0.15.1`
@steipete/summarize npm	`< 0.15.1`	`0.15.1`

Mô tả

Summarize prior to 0.15.0 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.

Mô tả của NVD

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.