Which versions of Repomix are affected by CVE-2026-59703?

Repomix contains a local file inclusion vulnerability (CVE-2026-59703) that allows unauthenticated remote attackers to read arbitrary files from git repositories on affected servers.. A patch is available.

How to fix or mitigate CVE-2026-59703?

24 hours: Disable or restrict network access to Repomix git clone HTTP endpoint; review access logs for suspicious clone requests using file:// schemes. 7 days: Implement network-level access controls (IP allowlist, VPN requirement); deploy WAF rules blocking file:// scheme parameters. 30 days: Monitor Repomix vendor advisory for patch availability; plan upgrade to patched version when released or evaluate replacement solution.

Repomix CVE-2026-59703

Q: What is the CVSS score of CVE-2026-59703?

CVE-2026-59703 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42273 HIGH

Files or Directories Accessible to External Parties (CWE-552)

2026-07-08 disclosure@vulncheck.com

GHSA-8wvr-gq96-hf34

Authentication Bypass Information Disclosure Path Traversal

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable endpoint (AV:N/PR:N/UI:N) with straightforward file:// bypass (AC:L); high confidentiality disclosure only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 16:01 EUVD

Analysis Generated

Jul 08, 2026 - 15:41 vuln.today

DescriptionCVE.org

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

AnalysisAI

Local file inclusion in Repomix's git clone HTTP endpoint lets unauthenticated remote attackers read arbitrary tracked file contents from git repositories on the server's filesystem. The isValidRemoteValue validation in src/core/git/gitRemoteParse.ts does not reject file:// scheme URLs, so a supplied file:///path/to/repo value is passed directly to git clone. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High) driven by high confidentiality impact with no authentication required.

Technical ContextAI

Repomix is a developer tool that packs the contents of a code repository into a single AI-friendly file; it exposes a server/API mode with a git clone endpoint that accepts a remote repository value and shells out to git clone. The root cause is CWE-552 (Files or Directories Accessible to External Parties): the isValidRemoteValue allow/deny logic in src/core/git/gitRemoteParse.ts is intended to constrain remote URLs to safe remote schemes but omits the file:// scheme from its blocklist. Because git natively supports the file:// transport for cloning from a local path, an attacker-controlled file:// URL causes git to clone from an arbitrary local directory, exposing all git-tracked file contents from that path back through the endpoint's normal packing output.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is commit c748b524f41225e7fc6f89ad0084520901a453cf (https://github.com/CrazyForks/repomix/commit/c748b524f41225e7fc6f89ad0084520901a453cf), which should be tracked to a tagged Repomix release and upgraded to once published. Until a patched release is confirmed, do not expose the Repomix git clone/server endpoint to untrusted networks: restrict access with network ACLs or authentication in front of the endpoint, and if the remote-clone feature is not needed, disable the server mode entirely. As a compensating control, run the Repomix process under a low-privilege account with a restricted filesystem view (e.g., a container or chroot) so that even a successful file:// clone cannot reach sensitive repositories or credentials - the trade-off is added deployment complexity and possible loss of legitimate local-path functionality. Refer to the VulnCheck advisory and GitHub issue #1704 for vendor guidance.