The vulnerability in steipete summarize before version 0.15.1 involves incorrect permission assignment for a critical resource. Specifically, during the refresh-free configuration rewrite path, the software creates a new configuration file with default process umask permissions instead of maintaining the original file's restrictive permissions. This leads to exposure of sensitive credentials to other local users on the same system who can read the configuration file due to overly permissive default permissions.

Local users on shared Unix-like systems can gain unauthorized read access to sensitive credentials including API keys and provider credentials stored in the summarize configuration file. This exposure could lead to credential compromise and unauthorized use of associated services. The vulnerability requires local access and does not involve user interaction or network exploitation. The CVSS 4.0 score is 6.8 (medium severity), reflecting the local attack vector and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should manually verify and correct the permissions of the summarize configuration file after any refresh-free rewrite operation to ensure sensitive credentials are not exposed. Restrict local user access to the system and configuration files as a temporary mitigation.