CVE-2026-59703: Repomix Local File Inclusion via Unvalidated Git URLs

Technical summary

CVE-2026-59703 is a local file inclusion (LFI) vulnerability in repomix's Git remote URL validation logic. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts does not implement adequate filtering to reject file:// scheme URLs. When an attacker submits a file:// URL to the git clone endpoint, the validation layer fails to block it, allowing the URL to pass through to git clone execution. Since git clone accepts file:// URLs for local repository operations, this enables direct filesystem access. The vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network-based attack surface, no authentication requirement, high confidentiality impact, and no integrity or availability impact.

Business impact

This vulnerability poses a significant confidentiality risk to organizations using repomix. Any unauthenticated attacker on the network can enumerate and read the contents of Git repositories accessible to the repomix process, potentially exposing source code, configuration files, secrets, and intellectual property. If repomix runs with elevated privileges or has access to sensitive repositories, the blast radius expands significantly. There is no integrity or availability impact, but the exposure of repository contents could inform further attacks or violate compliance requirements around data protection.

Affected systems

The vulnerability affects repomix installations where the git clone endpoint is accessible to untrusted network traffic. No specific version ranges were provided in the source data; verify against the official repomix security advisory for exact affected versions and any version that has received a patch. Organizations running repomix as a service or exposed to internet-facing requests are at highest risk.

Exploitability

Exploitation is straightforward and requires no authentication. An attacker needs only to craft a request to the git clone endpoint with a file:// URL pointing to a local repository path (e.g., file:///var/git/sensitive-repo). The low complexity and absence of user interaction requirements make this vulnerability practical to exploit at scale. However, the attacker must have network access to the repomix service and must know or guess valid repository paths on the target filesystem.

Remediation

Apply the security patch released for repomix immediately. The patch should enforce strict validation on git remote URLs within the isValidRemoteValue function to explicitly reject or sanitize file:// scheme URLs. Do not allow local filesystem paths to be treated as valid remote repositories unless this functionality is intentionally required and properly restricted. Additionally, review access controls on the git clone endpoint to ensure it is not unnecessarily exposed to untrusted networks.

Patch guidance

Consult the official repomix security advisory and repository for the patched version. Update repomix to the latest version that includes the fix for CVE-2026-59703. Verify against vendor releases that the patch properly blocks file:// URLs in the isValidRemoteValue function. Test in a non-production environment before rolling out to production systems.

Detection guidance

Monitor git clone endpoint logs and network traffic for requests containing file:// scheme URLs or suspicious local filesystem paths (e.g., /var, /home, /root, /tmp). Inspect repomix application logs for validation bypass attempts or unexpected cloning of local paths. Correlate git clone invocations with the source IP and timestamp to identify potential exploitation patterns. Consider implementing network-level detection rules to flag file:// URLs in HTTP/HTTPS requests to the git clone endpoint.

Why prioritize this

This vulnerability warrants immediate attention due to its HIGH CVSS score (7.5), zero authentication requirement, ease of exploitation, and direct impact on confidentiality of sensitive repository data. The presence of the vulnerability in a common utility path and its simplicity to exploit elevate urgency. While it is not currently listed on CISA's KEV catalog, the risk profile and potential for mass exploitation justify rapid remediation.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no privilege or authentication requirements (PR:N/UI:N), and high confidentiality impact (C:H). The lack of integrity and availability impact prevents a critical rating. Organizations should weigh internal factors—such as whether repomix is internet-facing, what repositories it can access, and the sensitivity of tracked files—when determining local risk and remediation priority.

Frequently asked questions