What’s Vulnerable › Vulnerabilities

CVE-2026-49987: Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-15 · updated 2026-10-24
• Weakness: CWE-88

Description

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

Affected products

• yamadashy repomix: before 1.14.1 — fixed in 1.14.1

How to fix

Upgrade to a fixed version: yamadashy repomix 1.14.1. Check the vendor advisory for mitigations.

References

• https://github.com/yamadashy/repomix/commit/92bfa3193b5233a0d21beff929444153c088de82
• https://github.com/yamadashy/repomix/releases/tag/v1.14.1
• https://github.com/yamadashy/repomix/security/advisories/GHSA-9mm9-rqhj-j5mx
• https://github.com/yamadashy/repomix/security/advisories/GHSA-9mm9-rqhj-j5mx

Get alerted when CVE-2026-49987 or the next vulnerability affects your stack