Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59702— repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack

Quick assessment

Affected
repomix repomix
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Repomix Repomix是Repomix公司开源的一个能够将整个代码仓库打包成单个、对 AI 友好的文件的工具，旨在解决将代码库喂给大语言模型（LLM）时的各种痛点。 Repomix 1.14.1之前版本存在服务端请求伪造漏洞，该漏洞源于对POST /api/pack端点中http://、https://和file:// URL验证不当，可能导致未经身份验证的攻击者发起任意出站请求，访问私有网络地址、GCP元数据服务或本地文件系统路径。

CVSS 9.3 · Critical EPSS 0.44% · P37

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
repomix repomix < 1.14.1 affected
≤ c748b52 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59702

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack
Source: CVE Program / CVE List V5
Vulnerability Description
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Repomix 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Repomix Repomix是Repomix公司开源的一个能够将整个代码仓库打包成单个、对 AI 友好的文件的工具，旨在解决将代码库喂给大语言模型（LLM）时的各种痛点。 Repomix 1.14.1之前版本存在服务端请求伪造漏洞，该漏洞源于对POST /api/pack端点中http://、https://和file:// URL验证不当，可能导致未经身份验证的攻击者发起任意出站请求，访问私有网络地址、GCP元数据服务或本地文件系统路径。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
repomix repomix 0 ~ 1.14.1 -

II. Public POCs for CVE-2026-59702

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Qwen3.6-35B-A3B · 9151 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-59702

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59702 (1)

Vendor Advisories for CVE-2026-59702 (1)

Other References for CVE-2026-59702 (1)

IV. Related Vulnerabilities

Same product: repomix
Same vendor: repomix
Same weakness: CWE-918

V. Comments for CVE-2026-59702

No comments yet

Leave a comment