npmPackage

repomix

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-49987High 7.5
Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection
Affected: fixed in 1.14.1.
Fixed in 1.14.1 (released May 26, 2026, 50 days before disclosure).
The latest release, 1.19.0, is not affected.
28% of repomix downloads last week were affected versions (34K).
CVE-2026-49988Medium 6.8
Repomix: attach_packed_output can bypass file-read secret scanning for supported local files
Affected: fixed in 1.14.1.
Fixed in 1.14.1 (released May 26, 2026, 50 days before disclosure).
The latest release, 1.19.0, is not affected.
28% of repomix downloads last week were affected versions (34K).