CVE-2026-59703

Name of the Vulnerable Software and Affected Versions repomix (affected versions not specified)

Description A local file inclusion issue exists in the git clone endpoint. The isValidRemoteValue() function in src/core/git/gitRemoteParse.ts does not block file:// URLs. This allows unauthenticated attackers to provide file:// scheme URLs that bypass validation and are passed to the git clone process, enabling unauthorized access to the contents of tracked files within arbitrary local git repositories on the server filesystem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.