CVE-2026-49987highCWE-88

CVE-2026-49987: high-severity vulnerability in yamadashy repomix

Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

Published

Follow this CVE+ Monitor repomix+ Monitor repomix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
yamadashy · repomix
Related CVEs — yamadashy repomix

In the same product, most dangerous first.

CVE-2026-49988MEDIUMRepomix: attach_packed_output can bypass file-read secret scanning for supported local filesEPSS 0.2%