repomix contains a local file inclusion flaw that allows unauthenticated attackers to send URLs with the file:// scheme to the git clone endpoint. The isValidRemoteValue function does not block such URLs, and the value is passed unchanged to the git clone command. The result is that any file tracked by the git repository can be read by the attacker, exposing source code, configuration files, or secrets. This is a classic example of CWE‑552, where an application reads files from the file system based on user input.

The affected product is repomix:repomix. No specific version information is listed in the CNA data, so any deployment of repomix that has not applied recent security updates is potentially vulnerable. Users should verify the installed package or source repository to confirm susceptibility.

The CVSS score of 8.7 places this vulnerability in the high severity range. The EPSS score of < 1% indicates a very low, but not zero, probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector involves sending unauthenticated HTTP requests to the git clone endpoint containing a file:// URL. The vulnerability allows reading any file under the Git process’s environment; however, the attacker must have network access to the server hosting repomix and the ability to submit requests to the exposed endpoint.