5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45243

CVE-2026-45243: Summarize contains a missing authorization vulnerability

Summarize prior to 0.15.0 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45243

CVE-2026-45243:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@steipete/summarize	npm	< 0.15.0	0.15.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists due to a missing authorization check in the communication channel between the web page context and the extension's privileged background script. The root cause is the handleArtifactsBridge function in the content script (automation.content.ts), which listens for window.postMessage events. This function unconditionally forwards messages formatted for 'summarize-artifacts' to the background script. A malicious script on a webpage can exploit this by sending a crafted message to trigger actions.

The message is then received by the background script's handler, created by createRuntimeActionsHandler. Prior to the patch, this handler did not validate if the tab sending the artifact request was authorized to do so. It would blindly execute operations like reading, creating, or deleting automation artifacts.

The patch remediates this by removing the insecure handleArtifactsBridge entirely and introducing an "arming" mechanism. Now, a trusted part of the extension must explicitly arm a tab, and the createRuntimeActionsHandler verifies this armed status using getArtifactsGuardError before processing any artifact-related requests, effectively closing the authorization gap.

Vulnerable functions

handleArtifactsBridge

apps/chrome-extension/src/entrypoints/automation.content.ts

This function establishes a message listener on the window object that acts as a bridge to the extension's background script. It lacks proper authorization, allowing any script on the webpage to send a crafted `postMessage` to execute privileged automation artifact operations (list, read, create, overwrite, delete). The vulnerability lies in trusting `window.postMessage` events without verifying the sender's identity or origin.

createRuntimeActionsHandler

apps/chrome-extension/src/entrypoints/background/runtime-actions.ts

This function creates the background script's message handler. The portion of the handler responsible for 'automation:artifacts' messages was vulnerable because it failed to check if the operation was authorized for the sending tab. It would process any request forwarded from the content script, which, as established, could be initiated by a malicious webpage. The patch introduces a guard (`getArtifactsGuardError`) to ensure the tab is explicitly "armed" before allowing artifact operations.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.