CVE-2026-49988 is an information exposure vulnerability in yamadashy repomix versions before 1.14.1. The flaw exists because the MCP server's attach_packed_output and read_repomix_output functions can register and read arbitrary local files with extensions .json, .txt, .md, or .xml without enforcing the file_system_read_file runSecretLint() safety check or validating Repomix packed-output. This allows callers with limited privileges to bypass local file-read secret-scanning protections and access sensitive data. The vulnerability is addressed by fixing these checks in repomix version 1.14.1.

An attacker with limited privileges on the affected system can read arbitrary local files of certain types, potentially exposing sensitive information that should be protected by secret-scanning boundaries. There is no indication of remote exploitation or privilege escalation beyond the local file read capability. The CVSS 4.0 base score is 6.8 (medium severity), reflecting local attack vector with low complexity and high impact on confidentiality.

Upgrade repomix to version 1.14.1 or later, where the vulnerability is fixed by enforcing the file_system_read_file runSecretLint() safety check and validating packed-output files properly. No other mitigations are indicated. Patch status is confirmed fixed in 1.14.1.