CVE-2026-45222

Name of the Vulnerable Software and Affected Versions Summarize versions prior to 0.14.1

Description The software creates the daemon configuration directory and file using default filesystem permissions that may be world-readable on Unix-like systems. This allows local attackers to read the ~/.summarize/daemon.json file, which contains bearer tokens and persisted provider API credentials. By exploiting these permissive permissions, an attacker can gain unauthorized access to the daemon or recover sensitive API keys.

Recommendations Update to the version containing commit 0cfb0fb.