repomix has 4 CVEs on record. The busiest recent month was July 2026 with 4. The median CVSS is 8.8 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 4
Worst active — by depth score
CVE-2026-59702Critical· 9.3repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack63CVE-2026-59703High· 7.5repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint53CVE-2026-49987High· 8.8repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection49CVE-2026-49988Mediumrepomix: attach_packed_output can bypass file-read secret scanning for supported local files28
repomix vulnerabilities
CVEs affecting repomix, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-59702Critical· 9.3PoCrepomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file://…
CVE-2026-59703High· 7.5PoCrepomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint
repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to bl…
CVE-2026-49987High· 8.8repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection
CVE-2026-49988Mediumrepomix: attach_packed_output can bypass file-read secret scanning for supported local files
repomix: attach_packed_output can bypass file-read secret scanning for supported local files