CVE-2026-59702 Details
Description
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
A server-side request forgery (SSRF) vulnerability has been identified in Repomix, specifically in versions prior to 1.14.1. The issue arises in the POST /api/pack endpoint, where the URL validation process fails to properly restrict http://, https://, and file:// URLs. This oversight allows unauthenticated attackers to make arbitrary outbound requests, potentially accessing private network addresses, Google Cloud Platform (GCP) metadata services, or local filesystem paths. The vulnerability was introduced in the Hono server and can be exploited by sending a crafted URL that bypasses the validation checks, enabling the server to make outbound requests to internal services or local files.
Users can update to Repomix version 1.14.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yamadashy/repomix/issues/1703 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/CrazyForks/repomix/commit/c748b524f41225e7fc6f89ad0084520901a453cf | [email protected] | Source CodeVendor |
| https://github.com/yamadashy/repomix | [email protected] | ProductSource CodeVendor |
| https://github.com/yamadashy/repomix/issues/1703 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/repomix-server-side-request-forgery-via-unvalidated-repository-urls-in-post-api-pack | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| repomix | < 1.14.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |