{"action":"Upgrade repomix to 1.14.1 or later.","affected":[{"fixed":"1.14.1","introduced":"0"}],"component":"repomix","cve_ids":["CVE-2026-49987"],"ecosystem":"npm","epss":0.00698,"exploited":false,"fixed_versions":["1.14.1"],"ghsa_id":"GHSA-9mm9-rqhj-j5mx","id":"tcs_01M5KFG8PK7T75R446M6FQ0ZKC","modified_at":"2026-07-01T19:26:31.109922Z","published_at":"2026-07-01T19:00:50Z","references":["https://osv.dev/vulnerability/GHSA-9mm9-rqhj-j5mx","https://github.com/yamadashy/repomix/security/advisories/GHSA-9mm9-rqhj-j5mx","https://github.com/yamadashy/repomix"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-9mm9-rqhj-j5mx","url":"https://osv.dev/vulnerability/GHSA-9mm9-rqhj-j5mx"}],"summary":"repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection"}