PT-2026-55216

Name of the Vulnerable Software and Affected Versions Repomix versions prior to 1.14.1 Description The MCP server in Repomix contains a flaw where the flow involving the attach packed output and read repomix output tools allows the registration and reading of arbitrary local .json, .txt, .md, or...

PT-2026-55132

attach packed output can register arbitrary .json/.txt/.md/.xml files and bypass the MCP file-read safety check Summary Repomix's MCP server exposes a normal file system read file tool that reads absolute paths only after running the project's secret check. However, the attach packed output plus...