CVE-2026-59702

Name of the Vulnerable Software and Affected Versions repomix (affected versions not specified)

Description A server-side request forgery (SSRF) issue exists in the 'POST /api/pack' endpoint. This occurs because the endpoint does not properly validate http://, https://, and file:// URLs before they are passed to the git clone function. Consequently, unauthenticated attackers can initiate arbitrary outbound requests to access private network addresses, GCP metadata services, or local filesystem paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the 'POST /api/pack' endpoint until the issue is resolved.