PT-2026-56469 · Repomix · Repomix

George Chen · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59703

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2026-59703

Affected Products

Repomix

References · 5

• https://github.com/CrazyForks/repomix/commit/c748b524f41225e7fc6f89ad0084520901a453cf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59703 · Security Note
• https://github.com/yamadashy/repomix · Note
• https://vulncheck.com/advisories/repomix-local-file-inclusion-via-file-url-scheme-in-git-clone-endpoint · Note
• https://github.com/yamadashy/repomix/issues/1704 · Note