CVE-2026-49987

Name of the Vulnerable Software and Affected Versions Repomix versions prior to 1.14.1

Description Repomix is vulnerable to argument injection via the --remote-branch CLI option. The application passes the value of the remoteBranch variable directly to git fetch and git checkout subprocesses within the execGitShallowClone() function in src/core/git/gitCommand.ts without proper validation or the use of the -- end-of-options delimiter. This allows an attacker to inject arbitrary Git options, such as --upload-pack, bypassing the security checks in validateGitUrl(). By specifying a local or SSH-style transport, an attacker can achieve arbitrary command execution with the privileges of the user running the tool. This could lead to complete system compromise or the compromise of CI/CD pipelines if the option is populated by external triggers.

Recommendations Update Repomix to version 1.14.1. As a temporary mitigation, avoid using the --remote-branch option with untrusted input.