repomix vulnerabilities

CVEs whose affected-version data names the repomix package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2026-59702Critical· 9.3PoC

3mo ago

repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack

repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file://…

▾ Abyssalrepomix · repomixEPSS 0.41%via CVEORG

CVE-2026-59703High· 7.5PoC

3mo ago

repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to bl…

▾ Midnightrepomix · repomixEPSS 0.51%via CVEORG

CVE-2026-49987High· 8.8

3mo ago

repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection

▾ Twilightrepomix · repomixEPSS 0.70%via GHSA

CVE-2026-49988Medium

3mo ago

repomix: attach_packed_output can bypass file-read secret scanning for supported local files

▾ Sunlitrepomix · repomixEPSS 0.18%via GHSA