CVE-2026-49987

Katalog CVE

CVSS 8.8 · High EPSS 0,70%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada yamadashy repomix. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection that bypasses validateGitUrl() dangerous parameter checks and can execute commands through local or SSH-style transports. This issue is fixed in version 1.14.1.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yamadashy/repomix/security/advisories/GHSA-9mm9-rqhj-j5mx exploit · advisory vendor · mitigasi
• https://github.com/yamadashy/repomix/commit/92bfa3193b5233a0d21beff929444153c088de82 patch
• https://github.com/yamadashy/repomix/releases/tag/v1.14.1 release notes