Executive brief
Repomix is a tool used to package entire code repositories into a single file for use with AI models. A security flaw in its web service allows unauthenticated attackers to force the server to make unauthorized requests to internal network addresses or local files. This could lead to the exposure of sensitive cloud metadata, private internal services, or local system files.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /api/pack endpoint of the Repomix web server. The application fails to properly validate repository URLs before passing them to the 'git clone' command. Specifically, the validation logic does not block http://, https://, or file:// protocols pointing to private IP ranges, cloud metadata services (like GCP's metadata server), or local filesystem paths. An unauthenticated remote attacker can exploit this to perform internal port scanning, access sensitive cloud service-account tokens, or read local files via the file:// protocol. The issue was addressed by enforcing an HTTPS-only allowlist and blocking private/reserved hostnames before the git sink.
Affected products
- repomix repomix < 1.14.1
Timeline
- 2026-06-02: disclosed: Initial report to vendor
- 2026-07-06: patched: Fix committed to repository
- 2026-07-08: advisory: CVE published