CVE-2026-49988

# `attach_packed_output` can register arbitrary `.json/.txt/.md/.xml` files and bypass the MCP file-read safety check ## Summary Repomix's MCP server exposes a normal `file_system_read_file` tool that reads absolute paths only after running the project's secret check. However, the `attach_packed_output` plus `read_repomix_output` flow can read arbitrary local `.json`, `.txt`, `.md`, or `.xml` files without the same safety check and without verifying that the file is actually a Repomix packed output. This is a medium-severity local MCP file-read boundary issue. The affected deployment is the documented `repomix --mcp` stdio server used by AI assistants. A prompt or lower-trust model action that can invoke MCP tools can use `attach_packed_output` on a local JSON/text file, receive an `outputId`, then call `read_repomix_output` to retrieve the full file content. ## Affected target - Repository: `yamadashy/repomix` - Commit reviewed: `adf5a12f2211a7fabf24ee11a21734adccee5143` - Component: MCP server tools - Package version reviewed: `[email protected]` ## Root cause The file-read safety boundary is implemented per tool rather than per local-file capability. `file_system_read_file` reads the file and runs `runSecretLint()` before returning content. `attach_packed_output` reads and registers local files through a separate path, but only checks file extension and parsing format. It does not verify a Repomix output header/schema and does not run the secret check before registering the path. ## Vulnerability chain 1. `attach_packed_output` accepts a direct file path, not only a directory. 2. `resolveOutputFilePath()` allows any file whose extension matches `.xml`, `.md`, `.txt`, or `.json`. 3. The tool reads that file with `fs.readFile(outputFilePath, 'utf8')`. 4. It extracts metrics, but malformed or non-Repomix JSON simply produces empty metrics rather than rejection. 5. `formatPackToolResponse()` registers the original file path under a generated `outputId`. 6. `rea