CVE-2026-59702 | BDVDB-2026-346352 Detail

Description#

repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-08Record published in the CVE List.
2. Version 22026-09-24Most recent update recorded in the CVE List.