CVE-2026-59703 Details
Description
repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.
A local file inclusion vulnerability has been identified in Repomix versions prior to 1.14.1. This vulnerability allows unauthenticated attackers to read arbitrary local git repositories by exploiting the git clone endpoint. The issue arises because the isValidRemoteValue function in the git remote parsing module fails to properly validate file:// URLs. As a result, attackers can supply file:// scheme URLs that bypass validation and are directly passed to the git clone command. This exploitation grants unauthorized access to all tracked file contents within the targeted git repositories on the server's filesystem.
Users can update to Repomix version 1.14.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yamadashy/repomix/issues/1704 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/CrazyForks/repomix/commit/c748b524f41225e7fc6f89ad0084520901a453cf | [email protected] | Source CodeVendor |
| https://github.com/yamadashy/repomix | [email protected] | ProductSource CodeVendor |
| https://github.com/yamadashy/repomix/issues/1704 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/repomix-local-file-inclusion-via-file-url-scheme-in-git-clone-endpoint | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| repomix | < 1.14.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |