CVE-2026-49988

attach_packed_output can register arbitrary .json/.txt/.md/.xml files and bypass the MCP file-read safety check

Repomix's MCP server exposes a normal file_system_read_file tool that reads absolute paths only after running the project's secret check. However, the attach_packed_output plus read_repomix_output flow can read arbitrary local .json, .txt, .md, or .xml files without the same safety check and without verifying that the file is actually a Repomix packed output.

This is a medium-severity local MCP file-read boundary issue. The affected deployment is the documented repomix --mcp stdio server used by AI assistants. A prompt or lower-trust model action that can invoke MCP tools can use attach_packed_output on a local JSON/text file, receive an outputId, then call read_repomix_output to retrieve the full file content.

Affected target

• Repository: yamadashy/repomix
• Commit reviewed: adf5a12f2211a7fabf24ee11a21734adccee5143
• Component: MCP server tools
• Package version reviewed: [email protected]

Root cause

The file-read safety boundary is implemented per tool rather than per local-file capability. file_system_read_file reads the file and runs runSecretLint() before returning content. attach_packed_output reads and registers local files through a separate path, but only checks file extension and parsing format. It does not verify a Repomix output header/schema and does not run the secret check before registering the path.

Vulnerability chain

1. attach_packed_output accepts a direct file path, not only a directory.
2. resolveOutputFilePath() allows any file whose extension matches .xml, .md, .txt, or .json.
3. The tool reads that file with fs.readFile(outputFilePath, 'utf8').
4. It extracts metrics, but malformed or non-Repomix JSON simply produces empty metrics rather than rejection.
5. formatPackToolResponse() registers the original file path under a generated outputId.
6. read_repomix_output resolves the outputId and returns the full file content.

Auth boundary violated

The respected boundary is the explicit local file-read guard: file_system_read_file blocks files that fail the secret scan.

The ignored boundary is the alternate packed-output path. A caller can register a supported-extension file as an output and read it through read_repomix_output without passing through runSecretLint() or a packed-output validation step.

Source trace

• src/mcp/tools/fileSystemReadFileTool.ts:72-83: direct file reads run runSecretLint() and return an error if the scan finds sensitive content.
• src/mcp/tools/attachPackedOutputTool.ts:76-87: direct file input is accepted based only on extension.
• src/mcp/tools/attachPackedOutputTool.ts:111-120: .json, .txt, .md, and .xml are supported formats.
• src/mcp/tools/attachPackedOutputTool.ts:228-240: JSON parse errors return empty metrics rather than rejecting the file as non-Repomix output.
• src/mcp/tools/attachPackedOutputTool.ts:272-308: the file is read and passed to formatPackToolResponse() without a secret check.
• src/mcp/tools/mcpToolRuntime.ts:77-82: formatPackToolResponse() registers the provided outputFilePath and reads it.
• src/mcp/tools/readRepomixOutputTool.ts:56-74: read_repomix_output reads the registered file path and returns its content.
• README.md:984-991: the tool is documented as providing secure access to existing packed outputs.

Reproduction

run.sh:

#!/usr/bin/env bash
set -euo pipefail
set +e
node run.js 2>&1 | tee transcript.txt
rc=${PIPESTATUS[0]}
set -e
printf '%s\n' "$rc" > exit-code.txt
exit "$rc"

The harness creates a temporary credentials.json containing a sentinel value, follows the attach_packed_output path for supported-extension files, registers the file path under an output ID, and then reads it back through the read_repomix_output path. It also checks the source-code contrast between the guarded direct file-read tool and the unguarded attach path.

Observed transcript:

ATTACH_TOOL_SOURCE_READS_FILE=true
ATTACH_TOOL_HAS_SECRETLINT_CHECK=false
READ_FILE_TOOL_HAS_SECRETLINT_CHECK=true
RUNTIME_REGISTERS_OUTPUT_PATH=true
ATTACH_ACCEPTS_JSON_EXTENSION=true
ATTACHED_NON_REPOMIX_JSON_PATH=true
SENTINEL_READ_BACK=true
REPOMIX_ATTACH_PACKED_OUTPUT_ARBITRARY_JSON_READ_REPRODUCED=true