CVE-2026-59702: repomix SSRF Vulnerability

CVE-2026-59702 Overview

CVE-2026-59702 is a server-side request forgery (SSRF) vulnerability [CWE-918] in repomix, an open-source tool that packages code repositories into AI-friendly formats. The flaw resides in the POST /api/pack endpoint, which accepts repository URLs without proper validation. Unauthenticated attackers can submit crafted http://, https://, or file:// URLs that repomix passes directly to git clone. This enables outbound requests to private network addresses, cloud metadata endpoints such as Google Cloud Platform (GCP) instance metadata, and local filesystem paths. The vulnerability affects hosted or self-hosted repomix instances exposing the pack API.

Critical Impact
Unauthenticated attackers can pivot into internal networks, harvest cloud instance credentials from metadata services, and read local files on the host running repomix.

Affected Products

repomix (yamadashy/repomix) — versions prior to the fix commit c748b524f41225e7fc6f89ad0084520901a453cf
Self-hosted repomix deployments exposing the POST /api/pack endpoint
Any repomix instance reachable from untrusted networks

Discovery Timeline

2026-07-08 - CVE-2026-59702 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59702

Vulnerability Analysis

repomix exposes an HTTP endpoint at POST /api/pack that accepts a repository URL and clones it for packaging. The endpoint does not validate the URL scheme or host before passing the value to the underlying git clone command. Because Git honors http://, https://, and file:// schemes, attackers control the destination of the outbound request. An attacker can direct repomix to internal-only endpoints such as http://169.254.169.254/computeMetadata/v1/ on GCP to retrieve instance metadata, service account tokens, and other sensitive values returned in error output or reflected repository content. The vulnerability is classified under [CWE-918] Server-Side Request Forgery.

Root Cause

The root cause is missing allowlist validation on the url parameter accepted by the pack endpoint. The handler trusts client-supplied input and forwards it to git clone without restricting scheme, resolving the hostname, or blocking RFC 1918 and link-local address ranges. No authentication is required to reach the endpoint, compounding the impact.

Attack Vector

Exploitation requires only network reachability to the repomix HTTP service. An attacker sends a POST /api/pack request containing a URL that targets an internal service, a cloud metadata IP, or a file:// path on the host. Git executes the clone attempt, and responses, errors, or cloned content can be reflected back to the attacker through the API response. Cloud-hosted instances on GCP are particularly exposed because the metadata service returns credentials on unauthenticated HTTP requests from the instance itself.

No verified public exploit code is available. Refer to the VulnCheck Security Advisory and GitHub Issue #1703 for technical detail.

Detection Methods for CVE-2026-59702

Indicators of Compromise

POST /api/pack requests containing URLs pointing to private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local 169.254.169.254, or localhost/127.0.0.1
Pack requests whose url parameter uses the file:// scheme referencing local paths such as /etc/passwd or cloud credential files
Outbound connections from the repomix host to cloud metadata endpoints (for example metadata.google.internal) not associated with normal workload behavior

Detection Strategies

Inspect HTTP access logs for POST /api/pack requests and parse the submitted url parameter against an allowlist of expected Git hosting providers.
Correlate repomix process activity with unexpected git clone invocations targeting non-public hosts or file:// URIs.
Alert on DNS resolutions from the repomix host that map to internal-only zones or metadata service hostnames.

Monitoring Recommendations

Enable request body logging on the reverse proxy fronting repomix to retain the full URL submitted with each pack request.
Monitor egress from the repomix host with network flow logs and flag connections to RFC 1918 space or 169.254.169.254.
Track error responses returned by /api/pack that include Git clone stderr, which often reveals SSRF probing attempts.

How to Mitigate CVE-2026-59702

Immediate Actions Required

Upgrade repomix to a version that includes commit c748b524f41225e7fc6f89ad0084520901a453cf or later.
Restrict network access to the /api/pack endpoint using authentication, IP allowlisting, or a reverse proxy until patched.
On cloud instances, enforce Instance Metadata Service v2 (IMDSv2) style protections or block metadata access from application workloads that do not require it.

Patch Information

The repomix maintainers addressed the vulnerability in commit c748b524f41225e7fc6f89ad0084520901a453cf, which introduces URL scheme and host validation before invoking git clone. Deployments should update to the fixed release and redeploy any container images built from vulnerable versions. Refer to the repomix repository for release details.

Workarounds

Place repomix behind an authenticating reverse proxy that rejects requests whose url parameter is not on an allowlist of trusted Git providers.
Configure egress firewall rules on the repomix host to deny outbound traffic to private CIDR ranges and cloud metadata IPs.
Run repomix in a sandbox or minimal container without access to sensitive local files or cloud credentials.

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP