repomix versions from 0.2.1 up to but not including 1.14.1 contain a command injection vulnerability via the `--remote-branch` CLI argument. This argument is passed unsanitized to git subprocesses, allowing injection of arbitrary git options such as `--upload-pack` that can execute attacker-controlled scripts with the user's privileges. The vulnerability bypasses existing URL validation controls because the branch parameter is not validated. A fix is available in version 1.14.1 that adds proper argument delimiters and validation.