repomix’s POST /api/pack endpoint accepts a repository URL that is passed directly to git clone without validation. The flaw, characterized as CWE‑918, allows an unauthenticated user to supply http://, https://, or file:// URLs that the server then fetches, making it possible to reach private network addresses, cloud‑platform metadata services, or local filesystem paths. This disclosure can leak sensitive data and facilitate further compromise through the server acting as a proxy for the attacker.

The vulnerable component is the repomix application (repomix:repomix). All installations that have not incorporated the commit c748b524f41225e7fc6f89ad0084520901a453cf, which introduces URL validation, remain susceptible to exploitation.

The CVSS score of 9.2 marks this flaw as critical, while the EPSS score of <1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only sending an HTTP request to the publicly exposed endpoint; no authentication is necessary. The likely attack vector is a simple HTTP POST to /api/pack with a crafted repository URL, enabling the attacker to query internal services, GCP metadata, or local files and potentially expose secrets or enable further attacks.