Answer in brief
CVE-2026-59702 records a Critical severity (CVSS 9.3) vulnerability in repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack. The current sources do not mark it as known exploited. The current feed maps repomix/repomix (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps repomix/repomix (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| repomix/repomixgeneric | >=0 <1.14.1 || 0 | 1.14.1 |
Published upstream
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-59702 records a Critical severity (CVSS 9.3) vulnerability in repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack. The current sources do not mark it as known exploited. The current feed maps repomix/repomix (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps repomix/repomix (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| repomix/repomixgeneric | >=0 <1.14.1 || 0 | 1.14.1 |
Published upstream
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.
Quoted source text, attributed separately from HOL analysis.