PT-2026-56469 · Repomix · Repomix

George Chen · Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-59703

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

Exploit

Correção

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-552

Identificadores relacionados

CVE-2026-59703

Produtos afetados

Repomix

Referências · 5

• 🔥 https://github.com/yamadashy/repomix/issues/1704 · Exploit
• https://github.com/yamadashy/repomix · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59703 · Nota de Segurança
• https://vulncheck.com/advisories/repomix-local-file-inclusion-via-file-url-scheme-in-git-clone-endpoint · Nota
• https://github.com/CrazyForks/repomix/commit/c748b524f41225e7fc6f89ad0084520901a453cf · Correção