CyberSecBulletin

Repomix vulnerabilities

We track 2 vulnerabilities in Repomix products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 8, 2026.

2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score

Latest Repomix vulnerabilities

  • 9.3 Critical severity

    repomix: Server-Side Request Forgery

    CVE-2026-59702Repomix

    repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing th

  • 7.5 High severity

    repomix: Files or Directories Accessible to External Parties

    CVE-2026-59703Repomix

    repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permi