CVE-2026-49987: Repomix Git Command Injection RCE Vulnerability

CVE-2026-49987 Overview

CVE-2026-49987 is a Git argument injection vulnerability in Repomix, a tool that packs repositories into AI-friendly files. Versions prior to 1.14.1 pass the --remote-branch value directly to git fetch and git checkout without validation or an --end-of-options separator. This allows an attacker to inject Git options such as --upload-pack, bypassing the dangerous parameter checks performed by validateGitUrl(). The flaw is tracked as [CWE-88: Argument Injection] and can lead to command execution through local or SSH-style transports.

Critical Impact
Attackers supplying a crafted remote branch reference can inject Git command-line options and achieve arbitrary command execution on the host running Repomix.

Affected Products

Repomix versions prior to 1.14.1
The src/core/git/gitCommand.ts module, specifically the execGitShallowClone function
Any workflow that invokes Repomix with attacker-influenced remote branch values

Discovery Timeline

2026-07-15 - CVE-2026-49987 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-49987

Vulnerability Analysis

Repomix clones remote repositories to package their contents for large language model consumption. The execGitShallowClone function in src/core/git/gitCommand.ts builds git fetch and git checkout command lines using the caller-provided remoteBranch value. The URL argument is checked by validateGitUrl(), but the branch parameter is not validated and no --end-of-options delimiter separates options from positional arguments.

Because git treats leading dashes as options, a branch string beginning with --upload-pack= or similar causes Git to interpret it as an option rather than a ref. An attacker who controls the branch input can therefore invoke arbitrary programs through Git transports that honor --upload-pack, or manipulate other Git internals.

Root Cause

The root cause is missing input validation on the remoteBranch parameter combined with the absence of the --end-of-options separator in the Git argument list. validateGitUrl() only inspects the URL, leaving the branch identifier as an unchecked injection point.

Attack Vector

Exploitation requires user interaction: the victim must run Repomix against a repository specification that contains an attacker-supplied branch value. This can occur through crafted configuration files, CI/CD pipelines that pass untrusted input to Repomix, or documentation that instructs users to run a specific command. Once the malicious option reaches git fetch, command execution occurs in the context of the user running Repomix.

typescript

   validateGitUrl(url);
 
   if (remoteBranch) {
+    validateGitRef(remoteBranch);
+
     await deps.execFileAsync('git', ['-C', directory, 'init']);
     await deps.execFileAsync('git', ['-C', directory, 'remote', 'add', '--', 'origin', url]);
     try {
+      // '--end-of-options' ensures the ref is never interpreted as a git option (argument injection guard)
       await deps.execFileAsync(
         'git',
-        ['-C', directory, 'fetch', '--depth', '1', 'origin', remoteBranch],
+        ['-C', directory, 'fetch', '--depth', '1', 'origin', '--end-of-options', remoteBranch],
         gitRemoteOpts,
       );
       await deps.execFileAsync('git', ['-C', directory, 'checkout', 'FETCH_HEAD']);

Source: GitHub Commit 92bfa31. The patch adds a validateGitRef() call and inserts --end-of-options before the branch argument, ensuring Git treats it strictly as a ref.

Detection Methods for CVE-2026-49987

Indicators of Compromise

Repomix process invocations where the branch argument begins with -- or contains upload-pack, receive-pack, or exec= substrings.
Child processes spawned by git fetch or git checkout that execute shells, interpreters, or network utilities not typically associated with Git operations.
Outbound SSH or file:// transport connections initiated by Repomix runs against untrusted repositories.

Detection Strategies

Inspect command-line telemetry for git executions containing branch tokens starting with a dash and lacking an --end-of-options separator.
Correlate Repomix package invocations with subsequent child processes to identify unexpected process trees originating from git fetch.
Audit CI/CD job logs and configuration files that supply branch parameters to Repomix, flagging values sourced from untrusted input.

Monitoring Recommendations

Enable process-creation logging on developer workstations and build agents that run Repomix versions below 1.14.1.
Alert on Git subprocesses that spawn unusual child binaries such as bash, sh, python, curl, or nc.
Monitor package manager events for Repomix installations and pin versions in lockfiles to detect drift.

How to Mitigate CVE-2026-49987

Immediate Actions Required

Upgrade Repomix to version 1.14.1 or later across all developer machines, CI runners, and container images.
Review automation that passes branch names to Repomix and reject any value starting with - until upgrades complete.
Rotate any credentials or tokens accessible to hosts that ran vulnerable Repomix versions against untrusted repositories.

Patch Information

The fix is available in Repomix 1.14.1. See the GitHub Release v1.14.1, the GitHub Security Advisory GHSA-9mm9-rqhj-j5mx, and the remediation commit 92bfa31. The patch introduces validateGitRef() and inserts --end-of-options before the branch argument in git fetch.

Workarounds

Restrict Repomix execution to trusted repositories and vetted branch inputs until the upgrade is deployed.
Wrap Repomix invocations in a validator that rejects branch strings matching the regex ^- or containing =.
Run Repomix in isolated sandboxes or ephemeral containers with no persistent credentials to limit blast radius.

bash

# Upgrade Repomix to the patched release
npm install -g repomix@1.14.1

# Verify the installed version
repomix --version

# Optional: pin the fixed version in package.json
npm pkg set devDependencies.repomix="^1.14.1"