Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-59703

repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-59703

Published

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-59703

Published

repomix

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "repomix",
                    "product": "repomix",
                    "defaultStatus": "affected",
                    "packageURL": "pkg:npm/repomix",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThan": "1.14.1"
                        },
                        {
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom",
                            "lessThanOrEqual": "c748b52"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON