The repomix tool versions before 1.14.1 contain an argument injection vulnerability (CWE-88) in the src/core/git/gitCommand.ts file. Specifically, the execGitShallowClone function passes the --remote-branch parameter directly to git fetch and git checkout commands without validation or the use of --end-of-options. This improper neutralization of argument delimiters allows attackers to inject additional Git options like --upload-pack, circumventing the validateGitUrl() checks and potentially executing arbitrary commands through local or SSH-style Git transports. The vulnerability has a CVSS 4.0 score of 7.5 (high severity) and is addressed by updating to repomix version 1.14.1.

An attacker can exploit this vulnerability to inject arbitrary Git command options, potentially leading to command execution on the system where repomix is run. This bypasses existing URL validation protections and can compromise the integrity and security of the repository operations. The impact includes high confidentiality, integrity, and availability risks as indicated by the CVSS vector.

This vulnerability is fixed in repomix version 1.14.1. Users should upgrade to version 1.14.1 or later to remediate this issue. No official patch or workaround is indicated beyond upgrading. Since this is not a cloud service, remediation depends on applying the fixed version.