https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T15:56:38.270337+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-49987 CVE-2026-49987 — Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection 2026-10-07T15:56:38.290130+00:00

Affected: yamadashy repomix

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.