yamadashy repomix up to 1.14.0 Git Command gitCommand.ts --remote-branch injection

Summaryinfo

A vulnerability has been found in yamadashy repomix up to 1.14.0 and classified as critical. This issue affects some unknown processing of the file src/core/git/gitCommand.ts of the component Git Command. The manipulation of the argument --remote-branch leads to injection. This vulnerability is documented as CVE-2026-49987. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in yamadashy repomix up to 1.14.0. This issue affects an unknown part of the file src/core/git/gitCommand.ts of the component Git Command. The manipulation of the argument --remote-branch with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-49987 since 06/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

Upgrading to version 1.14.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-44758). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• yamadashy

Name

• repomix

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14.0

Website

• Product: https://github.com/yamadashy/repomix/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion