From ded0c424cfaf017412cabe63a46286eb00274b6f Mon Sep 17 00:00:00 2001
From: gonzaloriestra <14979109+gonzaloriestra@users.noreply.github.com>
Date: Sun, 16 Aug 2026 00:19:58 +0000
Subject: [PATCH] [Security] Harden removeGitRemote against option injection

---
 packages/cli-kit/src/public/node/git.test.ts | 9 +++++++++
 packages/cli-kit/src/public/node/git.ts      | 5 +++++
 2 files changed, 14 insertions(+)

diff --git a/packages/cli-kit/src/public/node/git.test.ts b/packages/cli-kit/src/public/node/git.test.ts
index acff89c5765..e824602b1e5 100644
--- a/packages/cli-kit/src/public/node/git.test.ts
+++ b/packages/cli-kit/src/public/node/git.test.ts
@@ -537,4 +537,13 @@ describe('removeGitRemote()', () => {
     expect(mockedExeca).toHaveBeenCalledWith('git', ['remote'], {cwd: directory})
     expect(mockedExeca).not.toHaveBeenCalledWith('git', ['remote', 'remove', remoteName], {cwd: directory})
   })
+
+  test('throws an error if remote name starts with a hyphen', async () => {
+    const directory = '/test/directory'
+
+    await expect(git.removeGitRemote(directory, '-invalid-remote')).rejects.toThrowError(
+      /Invalid remote name: -invalid-remote. Remote names can't start with a hyphen./,
+    )
+    expect(mockedExeca).not.toHaveBeenCalled()
+  })
 })
diff --git a/packages/cli-kit/src/public/node/git.ts b/packages/cli-kit/src/public/node/git.ts
index e4ed42070ca..4f36309f1d0 100644
--- a/packages/cli-kit/src/public/node/git.ts
+++ b/packages/cli-kit/src/public/node/git.ts
@@ -431,6 +431,11 @@ export async function getLatestTag(directory?: string): Promise<string | undefin
  * @returns A promise that resolves when the remote is removed.
  */
 export async function removeGitRemote(directory: string, remoteName = 'origin'): Promise<void> {
+  // Guard against command/argument injection attacks if remoteName starts with '-'
+  if (remoteName.startsWith('-')) {
+    throw new AbortError(`Invalid remote name: ${remoteName}. Remote names can't start with a hyphen.`)
+  }
+
   outputDebug(outputContent`Removing git remote ${remoteName} from ${outputToken.path(directory)}...`)
   await ensureGitIsPresentOrAbort()