Skip to content
OpenAdvisories

Package · npm

repomix

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.8
    CVE-2026-49988

    Repomix: attach_packed_output can bypass file-read secret scanning for supported local files

    Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file…

    yamadashy repomix repomix npm