CVE-2026-49987 HIGH

CVE-2026-49987: Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

Vendor Yamadashy
Product repomix
Weakness CWE-88
Published July 15, 2026
Last update July 15, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

Key dates

02Disclosure timeline

July 15, 2026 CVE published
July 15, 2026 Record updated