Is CVE-2026-59703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59703 being exploited in the wild.

How severe is CVE-2026-59703?

High severity, with a CVSS score of 7.5, published 8 July 2026.

Is there a fix for CVE-2026-59703?

A patch was published on 2026-07-06: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59703 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-59703?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59703: Repomix local file inclusion in git clone endpoint

CVE-2026-59703 · Severity: high · CVSS 7.5 · Published 2026-07-08

Repomix is a tool used to package entire code repositories into a single file for use with AI models. A security flaw in its web-based service allows unauthenticated users to trick the server into reading local files and private Git repositories stored on the server's own hard drive. This could lead to the exposure of sensitive internal source code or configuration files, potentially compromising the security of the hosting infrastructure.

Quick answers

Is CVE-2026-59703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59703 being exploited in the wild.
How severe is CVE-2026-59703?: High severity, with a CVSS score of 7.5, published 8 July 2026.
Which products and versions are affected?: repomix repomix < 1.14.1.
Is there a fix for CVE-2026-59703?: A patch was published on 2026-07-06: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59703 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59703?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local file inclusion (LFI) vulnerability exists in the Repomix web backend due to insufficient validation of user-supplied repository URLs. The 'isValidRemoteValue' function in 'src/core/git/gitRemoteParse.ts' fails to restrict the 'file://' URI scheme. When an attacker provides a 'file://' URL, the 'git-url-parse' utility extracts a path that satisfies the application's shorthand validation patterns, allowing the URL to be passed directly to a 'git clone' command. An unauthenticated remote attacker can exploit this to clone and read any local Git repository accessible on the server's filesystem. This issue has been addressed in version 1.14.1 by enforcing an HTTPS-only allowlist for remote repository URLs.

Affected products

repomix repomix < 1.14.1

Timeline

2026-06-02: disclosed: Initial report to maintainers
2026-07-06: patched: Fix committed to repository
2026-07-08: advisory: CVE-2026-59703 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.