CVE-2026-49988
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Repomix MCP server before version 1.14.1 allows registering and reading arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation. This enables MCP callers to bypass the local file-read secret-scanning boundary.
Risk Assessment
An attacker can read sensitive data (e.g., passwords, API keys) from local files, leading to information disclosure and confidentiality breach.
Recommendation
Immediately update Repomix to version 1.14.1 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Repomix
See all- CVE-2026-59702Critical
Repomix contains a server-side request forgery (SSRF) vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
- CVE-2026-49987High
Repomix prior to version 1.14.1 contains a vulnerability in the execGitShallowClone function where the --remote-branch parameter is passed directly to git fetch and git checkout without validation or --end-of-options. This allows injection of Git options like --upload-pack, bypassing validateGitUrl() checks and enabling command execution via local or SSH transports.
- CVE-2026-59703High
Repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.
Original NVD description (English source)
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.