CVE-2026-45261CWE-94

GitButler: Link injection via forge integration enables arbitrary script execution

Critical · published May 28, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00492 · 41.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-28T16:20Z
EPSS history
Timeline
  • 28 MAY 16:20Z
    GitButler: Link injection via forge integration enables arbitrary script execution
    cvelistv5