diff --git a/metadata/multirepo/multirepo.go b/metadata/multirepo/multirepo.go
index e48cfaf8..7dd9f8d1 100644
--- a/metadata/multirepo/multirepo.go
+++ b/metadata/multirepo/multirepo.go
@@ -102,6 +102,18 @@ func NewConfig(repoMap []byte, roots map[string][]byte) (*MultiRepoConfig, error
 		}
 	}
 
+	// validation pass against malformed or adversarially crafted map
+	for i, m := range mapFile.Mapping {
+		if m == nil {
+			return nil, fmt.Errorf("mapping[%d] is null", i)
+		}
+		for _, repo := range m.Repositories {
+			if _, ok := mapFile.Repositories[repo]; !ok {
+				return nil, fmt.Errorf("mapping references unknown repository %q", repo)
+			}
+		}
+	}
+
 	return &MultiRepoConfig{
 		RepoMap:      mapFile,
 		TrustedRoots: roots,