CVE-2026-59703CWE-552

repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

High · published July 8, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
42.9
In the wild
Unconfirmed
What it is

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00514 · 42.9th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-07-08T14:55Z
EPSS history
Timeline
  • 08 JUL 14:55Z
    repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint
    cvelistv5