Argument injection in repomix npm package (CVE-2026-49987)

CVE-2026-49987 is an argument injection vulnerability (CWE-88) in the `repomix` npm package, affecting the `--remote-branch` CLI option. User-supplied input is passed unsanitized to `git fetch` and `git checkout` subprocesses in `src/core/git/gitCommand.ts` (`execGitShallowClone`), allowing an attacker to inject arbitrary git options such as `--upload-pack` to achieve arbitrary command execution with the privileges of the user running `repomix`. This bypasses the existing `dangerousParams` blocklist in `validateGitUrl()`, which validates only the URL parameter and not the branch parameter. Public POC available. Affected versions: - < 1.14.1 We recommend updating to: 1.14.1. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/yamadashy/repomix/security/advisories/GHSA-9mm9-rqhj-j5mx Details: https://vuln.today/cve/CVE-2026-49987