CVE-2026-49988

Undergoing Analysis Undergoing Analysis - In Progress

Repomix MCP Server Local File Read Vulnerability

Publication date: 2026-07-15

Last updated on: 2026-07-18

Assigner: GitHub, Inc.

Description

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-18

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-49988

EUVD

EUVD-2026-44757

Affected Vendors & Products

Vendor	Product	Version / Range
yamadashy	repomix	to 1.14.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-49988 is a medium-severity vulnerability in Repomix versions before 1.14.1. It allows bypassing file-read secret scanning for local files with extensions like .json, .txt, .md, or .xml. The issue occurs in the MCP server's attach_packed_output tool, which registers arbitrary local files without performing the same security checks as the file_system_read_file tool. Attackers with MCP tool access can read sensitive files by registering them as outputs and retrieving content via read_repomix_output, bypassing secret scanning.

Detection Guidance

Check if Repomix versions <= 1.14.0 are installed by running: npm list -g repomix or npm list repomix. Inspect MCP server logs for attach_packed_output and read_repomix_output tool calls. Monitor for unauthorized access to .json, .txt, .md, or .xml files via these tools.

Impact Analysis

An attacker with MCP tool access to a Repomix server could read sensitive files like project configurations or tokens without triggering secret scanning. This bypasses local file-read protections, potentially exposing confidential data. The attack requires only MCP tool access and local filesystem permissions, not shell execution or file writing.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing confidential files. Compliance may be impacted if sensitive data is leaked due to insufficient file access controls.

Mitigation Strategies

Update Repomix to version 1.14.1 or later immediately. Ensure all MCP servers using Repomix enforce secret scanning on attach_packed_output outputs. Review and restrict MCP tool access to trusted users only.

Hi! I’m here to help you understand CVE-2026-49988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70