PT-2026-44412 · Gitbutler · Gitbutler

Grumpinout1 · Published 2026-05-28 · Updated 2026-06-01 · CVE-2026-45261

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GitButler versions prior to 0.19.7

Description A remote code execution issue exists in the Tauri-based desktop application. An attacker can inject a malicious link into a pull request body; if a user clicks this link, it allows for arbitrary script execution within the Tauri webview. This issue only affects users who have enabled forge integration.

Recommendations Update to version 0.19.7. Disable forge integration to mitigate the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-45261

GHSA-XPMJ-536R-9FC6

Affected Products

Gitbutler

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45261.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45261 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45261 · Vendor Advisory
• https://github.com/gitbutlerapp/gitbutler/security/advisories/GHSA-xpmj-536r-9fc6 · Note
• https://t.me/cveNotify/165510 · Telegram Post