Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a file-read boundary bypass in Repomix's MCP server. It stems from the 'attach_packed_output' tool allowing the registration of arbitrary local files (.json, .txt, .md, .xml) without performing the secret scan that is enforced by the 'file_system_read_file' tool. An attacker can exploit this by first using 'attach_packed_output' to register a sensitive local file, which returns an 'outputId'. Then, the attacker can use this 'outputId' with the 'read_repomix_output' or 'grep_repomix_output' tools to read the file's content, effectively bypassing the secret scanning mechanism.
The patch addresses this by introducing a tracking mechanism. When 'attach_packed_output' registers a file, it now flags it as requiring a secret scan. The 'read_repomix_output' and 'grep_repomix_output' tools were modified to check for this flag before serving content. If the flag is present, they now perform a secret scan, mirroring the behavior of 'file_system_read_file' and closing the vulnerability. The identified vulnerable functions are the handlers for these three tools which, prior to the patch, collectively created the path to bypass the security control.
registerAttachPackedOutputTool.(anonymous)src/mcp/tools/attachPackedOutputTool.ts
registerReadRepomixOutputTool.(anonymous)src/mcp/tools/readRepomixOutputTool.ts
registerGrepRepomixOutputTool.(anonymous)src/mcp/tools/grepRepomixOutputTool.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| repomix | npm | <= 1.14.0 | 1.14.1 |