CVE-2026-49987 — Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

Affected: yamadashy repomix

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

GHSA-9mm9-rqhj-j5mx — repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection

Affected: npm: repomix

### Vulnerability Metadata

| Field | Detail | | --- | --- | | **Affected Component** | `src/core/git/gitCommand.ts` (`execGitShallowClone`) | | **Impact** | Arbitrary Command Execution / Security Control Bypass |

### Summary

The `--remote-branch` CLI option in `repomix` is vulnerable to argument injection. User-supplied input is passed directly to `git fetch` and `git checkout` subprocesses via `child_process.execFileAsync` without sanitization, `--` delimiters, or validation.

An attacker can inject arbitrary git command-line options. By injecting the `--upload-pack` option and specifying an SSH (`git@...`) or local (`file://`) remote URL, an attacker achieves arbitrary command execution with the privileges of the user running `repomix`. This bypasses the existing `dangerousParams` blocklist implemented in `validateGitUrl()`.

### Vulnerable Code Analysis

**File:** `src/core/git/gitCommand.ts`

The `remoteBranch` parameter is appended directly to the arguments array for git subprocesses without the `--` positional delimiter.

**Sink 1 (Lines 118-127):**

```typescript await deps.execFileAsync( 'git', ['-C', directory, 'fetch', '--depth', '1', 'origin', remoteBranch], // Vulnerable gitRemoteOpts, );

```

**Sink 2 (Lines 148-151):**

```typescript await deps.execFileAsync('git', ['-C', directory, 'checkout', remoteBranch]); // Vulnerable

```

**Bypassed Security Control (Lines 192-197):** The application attempts to prevent this exact vulnerability class by blocki…

Most recent entries from all

CVE-2026-49987 — Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

GHSA-9mm9-rqhj-j5mx — repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection