CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-59702 — repomix contains a server-side request forgery vulnerability in the POST /api/pa...

·Source: NIST NVD

Updated:

Executive Summary

repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.

Analysis

repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths. CVSS Score: 9.3. Published: 2026-07-08T16:16:31.577.

Indicators of Compromise (3)

CVE (1)
CVE-2026-59702
NVDMITRE CVE
URL (2)
http://,
VirusTotalURLhaus
https://,
VirusTotalURLhaus
Source Attribution

Originally published by NIST NVD on Jul 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Entra passkey enrollment vishing targets Microsoft 365 users

A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey. [...]

BleepingComputer
CRITICALVulnerability

NVD CRITICAL: CVE-2026-9074 — IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains...

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

CVE-2026-9074
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-3144 — IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could a...

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

CVE-2026-3144
NIST NVD