7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45242

CVE-2026-45242: Summarize < 0.15.1 Path Traversal via slidesDir Parameter

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45242

CVE-2026-45242:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@steipete/summarize	npm	< 0.15.0	0.15.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the /v1/summarize daemon endpoint, where the slidesDir parameter is not properly sanitized. The analysis of the patch commit ec8efd63295656fbfe8743620179c489bc5a242f reveals the exact location of the vulnerability. The file src/daemon/server-summarize-request.ts was modified to fix the issue. Specifically, the function resolveRequestSlidesSettings was changed to stop using the slidesDir value from the request body. Previously, the line slidesDir: request.slidesDir ?? ".summarize/slides" allowed an attacker to control the output directory for slide generation. The fix hardcodes this value to ".summarize/slides", effectively removing the path traversal vulnerability. The function parseSummarizeRequest is the higher-level function that orchestrates the request parsing and calls resolveRequestSlidesSettings, making it a key part of the exploitation chain.

Vulnerable functions

resolveRequestSlidesSettings

src/daemon/server-summarize-request.ts

The function `resolveRequestSlidesSettings` directly uses the `slidesDir` parameter from the user request. An attacker could provide a malicious path (e.g., `../../../../tmp/`) in the `slidesDir` parameter, causing the application to write files to an arbitrary location on the filesystem. The patch mitigates this by hardcoding the `slidesDir` value, ignoring any user-provided input.

parseSummarizeRequest

src/daemon/server-summarize-request.ts

The `parseSummarizeRequest` function is the entry point for handling the summarize request from the daemon. It calls the `resolveRequestSlidesSettings` function, which contains the path traversal vulnerability. Therefore, `parseSummarizeRequest` is part of the vulnerable execution flow that processes the malicious request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.