Skip to content
OpenAdvisories

Package · npm

repomix

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-49987

    Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

    Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload…

    yamadashy repomix repomix npm
  • Medium 6.8
    CVE-2026-49988

    Repomix: attach_packed_output can bypass file-read secret scanning for supported local files

    Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file…

    yamadashy repomix repomix npm