Repomix
Pack local or remote codebases into AI-friendly files that LLMs and coding agents can read or search
1.19.0version the registry lists (2 published)
2reported issues
Nolisted version affected
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.yamadashy/repomix
· Source code · Website
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| GHSA-hwpp-h97w-2h3jrepomix: attach_packed_output can bypass file-read secret scanning for supported local filesAlso filed as CVE-2026-49988 | medium | Not flagged | Jul 1, 2026 |
| GHSA-9mm9-rqhj-j5mxrepomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument InjectionAlso filed as CVE-2026-49987 | high | Not flagged | Jul 1, 2026 |
Versions in the registry
1.19.0 (listed), 1.18.1