diff --git a/packages/cli-kit/src/public/node/git.test.ts b/packages/cli-kit/src/public/node/git.test.ts
index acff89c5765..15a317fac8a 100644
--- a/packages/cli-kit/src/public/node/git.test.ts
+++ b/packages/cli-kit/src/public/node/git.test.ts
@@ -277,6 +277,15 @@ describe('commit()', () => {
 
     expect(mockedExeca).toHaveBeenCalledWith('git', ['commit', '-m', 'msg', '--author', author], {cwd: directory})
   })
+
+  test('throws an error if author starts with a hyphen', async () => {
+    const author = '-invalid-author'
+
+    await expect(git.createGitCommit('msg', {author})).rejects.toThrowError(
+      /Invalid commit author: -invalid-author. Author name\/email can't start with a hyphen./,
+    )
+    expect(mockedExeca).not.toHaveBeenCalled()
+  })
 })
 
 describe('getHeadSymbolicRef()', () => {
diff --git a/packages/cli-kit/src/public/node/git.ts b/packages/cli-kit/src/public/node/git.ts
index e4ed42070ca..cc535196dfb 100644
--- a/packages/cli-kit/src/public/node/git.ts
+++ b/packages/cli-kit/src/public/node/git.ts
@@ -299,6 +299,10 @@ export interface CreateGitCommitOptions {
 export async function createGitCommit(message: string, options?: CreateGitCommitOptions): Promise<string> {
   const args = ['commit', '-m', message]
   if (options?.author) {
+    // Guard against option injection attacks if author starts with '-'
+    if (options.author.startsWith('-')) {
+      throw new AbortError(`Invalid commit author: ${options.author}. Author name/email can't start with a hyphen.`)
+    }
     args.push('--author', options.author)
   }
   await gitCommand(args, options?.directory)