HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-59703 — repomix contains a local file inclusion vulnerability in the git clone endpoint ...

·Source: NIST NVD

Updated:

Executive Summary

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to a

Analysis

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem. CVSS Score: 7.5. Published: 2026-07-08T15:16:32.173.

Indicators of Compromise (1)

CVE (1)
CVE-2026-59703
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

RedWing Android Spyware Sold as a Service on Telegram

Zimperium found RedWing, an Android spyware sold as a service via Telegram to target banking apps

Infosecurity Magazine
MEDIUMVulnerability

Why Bangladesh’s new data protection law may fail to protect your data

Meem Arafat Manab reports: On August 19, 2025, hackers broke into Shwapno’s customer database. They took 410 gigabytes of data: the names, phone numbers, and purchase histories of forty lakh registered customers. They demanded $1.5 million. Shwapno refused, secured its systems, and said nothing to its customers for seven months. When the hackers published the... Source

DataBreaches.net
MEDIUMVulnerability

NextGen FinCrime 2026: How non-financial sectors can replicate banks’ success in fraud prevention

At the inaugural NextGen FinCrime event in 2026, Emma Lindley MBE kicked off sessions with a keynote on the evolving landscape of financial crime, emphasising the shift from traditional bank-based fraud to more sophisticated online attacks.

Finextra