CVE-2026-49988: Repomix Information Disclosure Flaw

CVE-2026-49988 Overview

CVE-2026-49988 is an information disclosure vulnerability in Repomix, a tool that packs repositories into AI-friendly files. The flaw affects the Repomix Model Context Protocol (MCP) server prior to version 1.14.1. The attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without invoking the file_system_read_filerunSecretLint() safety check or the Repomix packed-output validation. This allows MCP callers to bypass the local file-read secret-scanning boundary and retrieve sensitive content that would otherwise be filtered. The issue is tracked under [CWE-200] and resolved in Repomix 1.14.1.

Critical Impact
MCP callers can read arbitrary local files matching supported extensions without triggering secret redaction, exposing credentials, tokens, and other sensitive data.

Affected Products

Repomix versions prior to 1.14.1
Repomix MCP server attach_packed_output tool
Repomix MCP server read_repomix_output and grep_repomix_output tools

Discovery Timeline

2026-07-15 - CVE-2026-49988 published to NVD
2026-07-15 - GitHub Security Advisory GHSA-hwpp-h97w-2h3j published
2026-07-15 - Fix released in Repomix v1.14.1
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-49988

Vulnerability Analysis

Repomix exposes an MCP server that lets AI assistants pack and read repository content. To prevent secrets from leaking through the MCP interface, Repomix runs runSecretLint() on files served through file_system_read_file. The attach_packed_output tool bypassed this control. When a caller attached an external file as a packed output, the file was registered as a valid Repomix artifact and later served by read_repomix_output and grep_repomix_output without secret scanning.

Because the attach flow accepted arbitrary paths ending in .json, .txt, .md, or .xml, an MCP client could point the server at sensitive local files such as configuration files, environment dumps, or credential stores. The output was then returned unmodified to the caller. The vulnerability is classified as Information Exposure [CWE-200].

Root Cause

The root cause is a missing trust boundary between attach-sourced outputs and Repomix-generated packed outputs. attach_packed_output marked externally supplied files as trusted packed artifacts. Downstream read tools relied on that trust and skipped the secret-scanning step that normally protects local file reads. No validation confirmed that the attached file was actually produced by Repomix or that its content had been scanned.

Attack Vector

Exploitation requires local access with low privileges through an MCP-enabled client. An attacker with control over MCP tool invocations, such as a malicious prompt influencing an AI agent, can call attach_packed_output against any readable file matching the allowed extensions. A subsequent read_repomix_output or grep_repomix_output call returns the raw content, bypassing runSecretLint().

typescript

// Patch: src/mcp/tools/attachPackedOutputTool.ts
// fix(mcp): secret-scan attach-sourced outputs before serving them
           directory: path.basename(path.dirname(outputFilePath)),
         };
 
-        return await formatPackToolResponse(context, packResult, outputFilePath, topFilesLength);
+        // Mark this output as attach-sourced so read_repomix_output and
+        // grep_repomix_output secret-scan its content before serving it. The scan
+        // runs at serve time (not just here) so the boundary cannot be bypassed and
+        // stays correct even if the file changes after being attached.
+        return await formatPackToolResponse(context, packResult, outputFilePath, topFilesLength, true);
       } catch (error) {
         return buildMcpToolErrorResponse(convertErrorToJson(error));
       }

Source: GitHub Commit e447f7d

typescript

// Patch: src/mcp/tools/grepRepomixOutputTool.ts
// Adds runSecretLint import and requiresSecretScan check
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
+import { createSecretLintConfig, runSecretLint } from '../../core/security/workers/securityCheckWorker.js';
 import { logger } from '../../shared/logger.js';
 import {
   buildMcpToolErrorResponse,
   buildMcpToolSuccessResponse,
   convertErrorToJson,
   getOutputFilePath,
+  requiresSecretScan,
 } from './mcpToolRuntime.js';

Source: GitHub Commit e447f7d

Detection Methods for CVE-2026-49988

Indicators of Compromise

MCP server logs showing attach_packed_output calls referencing file paths outside the expected Repomix output directory.
read_repomix_output or grep_repomix_output invocations returning content from files with sensitive names such as .env, config.json, or credential manifests.
Repomix process reading files in user home directories, /etc, or project directories not intended for packing.

Detection Strategies

Enable verbose MCP server logging and audit every attach_packed_output call, correlating the target path with the expected Repomix workspace.
Alert on file-read events by the Repomix process where the target path matches sensitive locations or extensions of interest.
Inspect running Repomix versions across developer endpoints and flag any instance below 1.14.1.

Monitoring Recommendations

Baseline normal Repomix file-access patterns and alert on deviations, especially reads outside repository roots.
Monitor AI agent transcripts for MCP tool calls that reference absolute paths to configuration or secret files.
Track outbound data volumes from AI assistants that use Repomix, since bypassed scans could exfiltrate large secret-bearing files.

How to Mitigate CVE-2026-49988

Immediate Actions Required

Upgrade Repomix to version 1.14.1 or later on every host that runs the MCP server.
Audit MCP client configurations and remove access for untrusted AI agents or extensions that could call attach_packed_output.
Review recent MCP session logs for suspicious attach or read calls and rotate any credentials that may have been exposed.

Patch Information

The fix ships in Repomix v1.14.1. Commit e447f7d marks attach-sourced outputs so that read_repomix_output and grep_repomix_output run runSecretLint() at serve time. The scan executes on every read, preventing bypass even if the underlying file changes after being attached. See the GitHub Security Advisory GHSA-hwpp-h97w-2h3j for full details.

Workarounds

Disable the Repomix MCP server until the upgrade to 1.14.1 is complete.
Restrict the Repomix process with filesystem access controls, such as running it under a dedicated user with read access only to intended repository directories.
Remove or block the attach_packed_output tool from MCP client tool allowlists if immediate patching is not possible.

bash

# Upgrade Repomix to the patched release
npm install -g repomix@1.14.1

# Verify the installed version
repomix --version

# Optional: restrict the MCP server to a dedicated workspace
cd /srv/repomix-workspace
repomix --mcp