Vulnerabilidades do Repomix Repomix
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Repomix Repomix: 2 registro(s), com versões afetadas e correções.
CVE-2026-59702
Crítica · 9.3
CWE-918 08/07/2026
repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
CVE-2026-59703
Alta · 7.5
CWE-552 08/07/2026
repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint
repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.