https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 16:12:32 +0000 https://vulnerability.circl.lu/vuln/brew-repomix-cve-2026-49988 <p><strong>Affected:</strong> Homebrew: repomix</p> <p># `attach_packed_output` can register arbitrary `.json/.txt/.md/.xml` files and bypass the MCP file-read safety check</p> <p>## Summary</p> <p>Repomix&#39;s MCP server exposes a normal `file_system_read_file` tool that reads absolute paths only after running the project&#39;s secret check. However, the `attach_packed_output` plus `read_repomix_output` flow can read arbitrary local `.json`, `.txt`, `.md`, or `.xml` files without the same safety check and without verifying that the file is actually a Repomix packed output.</p> <p>This is a medium-severity local MCP file-read boundary issue. The affected deployment is the documented `repomix --mcp` stdio server used by AI assistants. A prompt or lower-trust model action that can invoke MCP tools can use `attach_packed_output` on a local JSON/text file, receive an `outputId`, then call `read_repomix_output` to retrieve the full file content.</p> <p>## Affected target</p> <p>- Repository: `yamadashy/repomix` - Commit reviewed: `adf5a12f2211a7fabf24ee11a21734adccee5143` - Component: MCP server tools - Package version reviewed: `repomix@1.14.0`</p> <p>## Root cause</p> <p>The file-read safety boundary is implemented per tool rather than per local-file capability. `file_system_read_file` reads the file and runs `runSecretLint()` before returning content. `attach_packed_output` reads and registers local files through a separate path, but only checks file extension and parsing format. It does not verify a Repomix output header/schema and does not run the secret check before registeri…</p> <p><strong>Affected:</strong> Homebrew: repomix</p> <p># `attach_packed_output` can register arbitrary `.json/.txt/.md/.xml` files and bypass the MCP file-read safety check</p> <p>## Summary</p> <p>Repomix&#39;s MCP server exposes a normal `file_system_read_file` tool that reads absolute paths only after running the project&#39;s secret check. However, the `attach_packed_output` plus `read_repomix_output` flow can read arbitrary local `.json`, `.txt`, `.md`, or `.xml` files without the same safety check and without verifying that the file is actually a Repomix packed output.</p> <p>This is a medium-severity local MCP file-read boundary issue. The affected deployment is the documented `repomix --mcp` stdio server used by AI assistants. A prompt or lower-trust model action that can invoke MCP tools can use `attach_packed_output` on a local JSON/text file, receive an `outputId`, then call `read_repomix_output` to retrieve the full file content.</p> <p>## Affected target</p> <p>- Repository: `yamadashy/repomix` - Commit reviewed: `adf5a12f2211a7fabf24ee11a21734adccee5143` - Component: MCP server tools - Package version reviewed: `repomix@1.14.0`</p> <p>## Root cause</p> <p>The file-read safety boundary is implemented per tool rather than per local-file capability. `file_system_read_file` reads the file and runs `runSecretLint()` before returning content. `attach_packed_output` reads and registers local files through a separate path, but only checks file extension and parsing format. It does not verify a Repomix output header/schema and does not run the secret check before registeri…</p> https://vulnerability.circl.lu/vuln/brew-repomix-cve-2026-49988 https://vulnerability.circl.lu/vuln/cve-2026-49988 <p><strong>Affected:</strong> yamadashy repomix</p> <p>Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.</p> <p><strong>Affected:</strong> yamadashy repomix</p> <p>Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation, allowing MCP callers to bypass the local file-read secret-scanning boundary. This issue is fixed in version 1.14.1.</p> https://vulnerability.circl.lu/vuln/cve-2026-49988