CVE-2026-49987
High
Description
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.
SeverityHigh
CVSS8.8
Exploit probability—
ProductYamadashy Repomix
PublishedJul 15, 2026
First seenJul 15, 2026
Weakness typeCWE-88CWE-88
How to fix
Update
- yamadashy repomix1.14.1 or later
- repomix1.14.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yamadashy repomix | v < 1.14.1 | 1.14.1 |
| repomixnpm | v < 1.14.1 | 1.14.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.