CVE-2026-59703

HighCVSS 7.5/10Last modified Jul 10, 2026

Description

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2026
Last modified: Jul 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-597047.1Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles,CVE-2026-597059.8mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and d CVE-2026-597069.3mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-CVE-2026-597078.6LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fe CVE-2026-597087.5The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, all CVE-2026-597094.3Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Im CVE-2026-59719.8A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xml_fill of the file metag CVE-2026-597106.1showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails t CVE-2026-597116.1showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScr CVE-2026-597128.1Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user c CVE-2026-597138.1Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state pa CVE-2026-597147.1Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can o