CVE-2026-59702
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Repomix contains a server-side request forgery (SSRF) vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
Risk Assessment
The risk includes unauthorized access to internal network resources, leakage of sensitive data from cloud metadata services (e.g., GCP), and reading local system files, which could lead to privilege escalation or confidentiality breaches.
Recommendation
Immediately update repomix to a version that includes a fix for URL validation in the POST /api/pack endpoint. Until an update is available, restrict access to this endpoint using a firewall or authentication.
Original NVD description (English source)
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.