Skip to content
OpenAdvisories

Package · npm

repomix

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-49987

    Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

    Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload…

    yamadashy repomix repomix npm