Server-Side Request Forgery in Repomix Affects Unauthenticated Users

CVE-2026-59702

What is CVE-2026-59702?

Repomix includes a security vulnerability rooted in the handling of requests at the POST /api/pack endpoint. This flaw permits unauthorized users to issue arbitrary outbound requests by exploiting the failure to properly validate various URL schemas, such as http://, https://, and file://. As a result, attackers can potentially access sensitive information from private network addresses, GCP metadata services, or local filesystem paths. This oversight poses significant risks, particularly for deployments where access controls are not strictly enforced.

References