CVE-2026-49988: repomix: attach_packed_output can bypass file-read secret scanning for supported local files

The file_system_read_file tool reads an absolute path only after runSecretLint() finds no secrets. attach_packed_output has no such check. It accepts a direct file path, checks only the extension, reads the file and treats a parse failure on non-Repomix JSON as empty metrics instead of rejecting it. formatPackToolResponse() then registers the path under an outputId, and read_repomix_output returns the file's content.

So an MCP caller can chain two calls and read a plaintext file that the guarded tool would block. The reporter's harness read back a sentinel value from a temporary credentials.json. Project config JSON, exported tokens and tool settings are the kind of files at risk. Files with other extensions are not reachable this way, and no shell or file write is needed.

The caller is whatever can invoke MCP tools: an assistant steered by a prompt injection, or a lower-trust model action. The server runs locally over stdio with the user's file access. The README describes the tool as secure access to existing packed outputs, which is the expectation this breaks.

Affected: npm repomix up to and including 1.14.0, when run as the MCP server with repomix --mcp. Normal command-line packing is not the exposed path.

npx repomix --version

For a global install use npm ls -g repomix. Check your MCP host config for a repomix --mcp entry and which version it launches.

Upgrade to repomix 1.14.1.

npm install -g [email protected]

If your MCP host launches it through npx, pin [email protected] in the config and restart the host. The advisory lists no workaround. Its suggested fix is to validate that the target is a real Repomix output, reject other files, and run the same secret check before registering or returning content. Until you upgrade, avoid running the server where untrusted content can steer the assistant.

Review MCP tool-call history for attach_packed_output calls that point to a file that is not a Repomix output, for instance credentials.json or a config file. Look for a following read_repomix_output call using the returned outputId. Beam records agent MCP tool calls and file access, and its rules flag risky ones, so the two-step read is visible there.

attach_packed_output can register arbitrary .json/.txt/.md/.xml files and bypass the MCP file-read safety check

Summary

Repomix's MCP server exposes a normal file_system_read_file tool that reads absolute paths only after running the project's secret check. However, the attach_packed_output plus read_repomix_output flow can read arbitrary local .json, .txt, .md, or .xml files without the same safety check and without verifying that the file is actually a Repomix packed output.

This is a medium-severity local MCP file-read boundary issue. The affected deployment is the documented repomix --mcp stdio server used by AI assistants. A prompt or lower-trust model action that can invoke MCP tools can use attach_packed_output on a local JSON/text file, receive an outputId, then call read_repomix_output to retrieve the full file content.

Affected target

• Repository: yamadashy/repomix
• Commit reviewed: adf5a12f2211a7fabf24ee11a21734adccee5143
• Component: MCP server tools
• Package version reviewed: [email protected]

Root cause

The file-read safety boundary is implemented per tool rather than per local-file capability. file_system_read_file reads the file and runs runSecretLint() before returning content. attach_packed_output reads and registers local files through a separate path, but only checks file extension and parsing format. It does not verify a Repomix output header/schema and does not run the secret check before registering the path.

Vulnerability chain

1. attach_packed_output accepts a direct file path, not only a directory.
2. resolveOutputFilePath() allows any file whose extension matches .xml, .md, .txt, or .json.
3. The tool reads that file with fs.readFile(outputFilePath, 'utf8').
4. It extracts metrics, but malformed or non-Repomix JSON simply produces empty metrics rather than rejection.
5. formatPackToolResponse() registers the original file path under a generated outputId.
6. read_repomix_output resolves the outputId and returns the full file content.

Auth boundary violated

The respected boundary is the explicit local file-read guard: file_system_read_file blocks files that fail the secret scan.

The ignored boundary is the alternate packed-output path. A caller can register a supported-extension file as an output and read it through read_repomix_output without passing through runSecretLint() or a packed-output validation step.

Source trace

• src/mcp/tools/fileSystemReadFileTool.ts:72-83: direct file reads run runSecretLint() and return an error if the scan finds sensitive content.
• src/mcp/tools/attachPackedOutputTool.ts:76-87: direct file input is accepted based only on extension.
• src/mcp/tools/attachPackedOutputTool.ts:111-120: .json, .txt, .md, and .xml are supported formats.
• src/mcp/tools/attachPackedOutputTool.ts:228-240: JSON parse errors return empty metrics rather than rejecting the file as non-Repomix output.
• src/mcp/tools/attachPackedOutputTool.ts:272-308: the file is read and passed to formatPackToolResponse() without a secret check.
• src/mcp/tools/mcpToolRuntime.ts:77-82: formatPackToolResponse() registers the provided outputFilePath and reads it.
• src/mcp/tools/readRepomixOutputTool.ts:56-74: read_repomix_output reads the registered file path and returns its content.
• README.md:984-991: the tool is documented as providing secure access to existing packed outputs.

Reproduction

run.sh:

#!/usr/bin/env bash
set -euo pipefail
set +e
node run.js 2>&1 | tee transcript.txt
rc=${PIPESTATUS[0]}
set -e
printf '%s\n' "$rc" > exit-code.txt
exit "$rc"

The harness creates a temporary credentials.json containing a sentinel value, follows the attach_packed_output path for supported-extension files, registers the file path under an output ID, and then reads it back through the read_repomix_output path. It also checks the source-code contrast between the guarded direct file-read tool and the unguarded attach path.

Observed transcript:

ATTACH_TOOL_SOURCE_READS_FILE=true
ATTACH_TOOL_HAS_SECRETLINT_CHECK=false
READ_FILE_TOOL_HAS_SECRETLINT_CHECK=true
RUNTIME_REGISTERS_OUTPUT_PATH=true
ATTACH_ACCEPTS_JSON_EXTENSION=true
ATTACHED_NON_REPOMIX_JSON_PATH=true
SENTINEL_READ_BACK=true
REPOMIX_ATTACH_PACKED_OUTPUT_ARBITRARY_JSON_READ_REPRODUCED=true

Impact

In the MCP threat model, an assistant/tool caller can read local JSON/text/Markdown/XML files through a path that bypasses the file-read tool's secret scanning. Examples include project configuration JSON, exported tokens, local tool settings, or other plaintext files with supported extensions.

This does not require shell execution or writing files. It requires MCP tool-call capability against a Repomix server running with local filesystem access.

Suggested fix

Apply the same safety boundary to all local-file read paths:

• Require attach_packed_output to validate that the target file is a genuine Repomix output before registration.
• Reject malformed/non-Repomix JSON/XML/Markdown/plain files instead of registering them with empty metrics.
• Run the same secret check used by file_system_read_file before registering or returning content.
• Consider storing a content snapshot in the registry rather than registering arbitrary local paths for later reads.