CVE-2026-49987

Undergoing Analysis Undergoing Analysis - In Progress

Remote Git Option Injection in Repomix

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-49987

EUVD

EUVD-2026-44758

Affected Vendors & Products

Vendor	Product	Version / Range
yamadashy	repomix	to 1.14.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

CVE-2026-49987 is a command injection vulnerability in the repomix tool versions before 1.14.1. It occurs when the --remote-branch parameter is passed directly to git fetch and git checkout commands without validation. Attackers can inject malicious Git options like --upload-pack to execute arbitrary commands through local or SSH transports.

Detection Guidance

Check repomix version with npm list -g repomix or repomix --version. If version is below 1.14.1, the system is vulnerable. Inspect git commands in repomix logs for unusual options like --upload-pack or --exec. Monitor for unexpected command execution in CI/CD pipelines using repomix.

Impact Analysis

This vulnerability allows remote code execution (RCE) with the privileges of the user running repomix. Attackers could execute malicious commands, potentially leading to data theft, system compromise, or further network infiltration. It is particularly dangerous in CI/CD environments where repomix processes untrusted input.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable repomix versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Update repomix to version 1.14.1 or later immediately. If updating is not possible, avoid using repomix with untrusted input or disable it until patched. Review and restrict git command execution in CI/CD environments to prevent command injection.

Hi! I’m here to help you understand CVE-2026-49987. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70