CVE-2026-59703: Repomix Path Traversal Vulnerability

CVE-2026-59703 Overview

CVE-2026-59703 is a Local File Inclusion (LFI) vulnerability in repomix, an open-source tool that packages code repositories for use with AI tooling. The flaw exists in the git clone endpoint and allows unauthenticated attackers to read arbitrary local git repositories on the server filesystem. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts does not block file:// URLs. Attackers can supply a file:// scheme URL that bypasses validation and is passed directly to git clone, exposing all tracked file contents from any local repository the server process can access.

Critical Impact
Unauthenticated network attackers can read arbitrary local git repository contents from the server filesystem without any user interaction.

Affected Products

repomix (yamadashy/repomix) hosted git clone endpoint
Website pack service in website/server/src/domains/pack/remoteRepo.ts
Any deployment exposing the repomix pack endpoint publicly

Discovery Timeline

2026-07-08 - CVE-2026-59703 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59703

Vulnerability Analysis

The vulnerability is classified as [CWE-552] Files or Directories Accessible to External Parties. repomix exposes an endpoint that accepts a remote repository URL and invokes git clone on it. Input validation is performed by isValidRemoteValue in src/core/git/gitRemoteParse.ts, which is intended to restrict inputs to remote repository URLs. The function fails to reject the file:// scheme, so any local path formatted as file:///path/to/repo passes validation. Because git clone natively supports the file:// transport, the underlying process reads the target repository from disk and returns its tracked contents to the requester. This turns a repository packing feature into an arbitrary local repository read primitive available to unauthenticated attackers over the network.

Root Cause

The root cause is an allow-list gap in isValidRemoteValue. The validator does not enforce that submitted URLs use https:// or another safe remote scheme, and it does not explicitly deny file://. Trust in the parsed value is then propagated to git clone without further scheme enforcement.

Attack Vector

An unauthenticated attacker sends a crafted request to the git clone endpoint with a file:// URL pointing to a local git repository path. The server invokes git clone against that path, packages the tracked contents, and returns them. No credentials, tokens, or user interaction are required.

typescript

// Security patch in website/server/src/domains/pack/remoteRepo.ts
// Source: https://github.com/CrazyForks/repomix/commit/c748b524f41225e7fc6f89ad0084520901a453cf
 import { generateCacheKey } from './utils/cache.js';
 import { cleanupTempDirectory, copyOutputToCurrentDirectory, createTempDirectory } from './utils/fileUtils.js';
 import { cache } from './utils/sharedInstance.js';
+import { assertPublicHttpsRepoUrl } from './validateRemoteRepoUrl.js';

 const execFileAsync = promisify(execFile);

The patch adds assertPublicHttpsRepoUrl to restrict the website pack clone flow to public https:// URLs, blocking the file:// scheme and other non-HTTPS transports before git clone is invoked.

Detection Methods for CVE-2026-59703

Indicators of Compromise

Inbound HTTP requests to the repomix pack or git clone endpoint containing file:// in the URL parameter
Server-side git clone process invocations with a file:// argument in command-line telemetry
Unexpected read access to local git repositories by the repomix service account
Outbound HTTP responses from the repomix service containing contents of local, non-public repositories

Detection Strategies

Inspect application and reverse proxy logs for request bodies or query parameters containing the string file:// targeting the repomix endpoint.
Monitor process execution telemetry for git clone file://* invocations spawned by the repomix service user.
Alert on repomix responses whose size or content signature matches internal repositories that should not be exposed externally.

Monitoring Recommendations

Enable command-line auditing on hosts running repomix to capture full git invocations and their URL arguments.
Forward web server, application, and process telemetry to a centralized analytics platform and retain requests to the pack endpoint.
Baseline normal git clone remotes for the repomix service and alert on any non-https:// scheme.

How to Mitigate CVE-2026-59703

Immediate Actions Required

Update repomix to a version containing commit c748b524f41225e7fc6f89ad0084520901a453cf or later, which adds assertPublicHttpsRepoUrl.
Restrict network exposure of the repomix pack endpoint to trusted users until the patch is deployed.
Audit access logs for prior requests containing file:// URLs and treat any matches as suspected data exposure.

Patch Information

The upstream fix is available in the GitHub commit c748b524, which enforces public https:// repository URLs in the website pack clone flow. Additional context is available in the VulnCheck Security Advisory and GitHub Issue #1704.

Workarounds

Place the repomix endpoint behind a reverse proxy or WAF rule that rejects any request whose URL parameter starts with file://, ftp://, or other non-HTTPS schemes.
Run the repomix service under a dedicated low-privilege user with no read access to local git repositories or sensitive directories.
Deploy repomix inside a container with a minimal filesystem that contains no additional git repositories or secrets.

bash

# Example nginx rule to block file:// scheme submissions to the pack endpoint
location /api/pack {
    if ($arg_url ~* "^file://") {
        return 400;
    }
    if ($request_body ~* "file://") {
        return 400;
    }
    proxy_pass http://repomix_upstream;
}