CVE-2026-49988

Katalog CVE

CVSS 5.5 · Medium EPSS 0,18%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada yamadashy repomix. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yamadashy/repomix/security/advisories/GHSA-hwpp-h97w-2h3j exploit · advisory vendor
• https://github.com/yamadashy/repomix/commit/e447f7dba6f51fdb26bcad0c280542fca291960e patch
• https://github.com/yamadashy/repomix/releases/tag/v1.14.1 release notes