PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45261 gitbutlerapp CVE debrief

A critical remote code execution vulnerability exists in GitButler desktop application versions prior to 0.19.7. The Tauri-based application fails to properly sanitize pull request body content, allowing an attacker to inject malicious links that execute arbitrary scripts in the Tauri webview when clicked. This vulnerability requires user interaction (clicking the malicious link) and affects only users who have enabled forge integration. The CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and high impact across confidentiality, integrity, and availability. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code).

Vendor
gitbutlerapp
Product
gitbutler
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-01
Advisory published
2026-05-28
Advisory updated
2026-06-01

Who should care

Organizations and individual developers using GitButler desktop application with forge integration enabled. Security teams managing software development toolchains. Developers working in environments where untrusted pull requests may be reviewed.

Technical summary

The GitButler desktop application, built on the Tauri framework, contains a remote code execution vulnerability in its handling of pull request body content. The application renders pull request bodies within a Tauri webview without adequate input sanitization. An attacker can craft a malicious pull request containing a specially designed link that, when clicked by a victim user, triggers arbitrary script execution within the webview context. This script execution operates with the privileges of the GitButler application, potentially allowing system compromise. The attack requires: (1) the victim has enabled forge integration in GitButler, (2) the victim views a malicious pull request, and (3) the victim clicks the injected malicious link. The vulnerability is resolved in version 0.19.7 through implementation of proper link sanitization and/or execution context restrictions.

Defensive priority

critical

Recommended defensive actions

  • Upgrade GitButler desktop application to version 0.19.7 or later immediately
  • If immediate upgrade is not possible, disable forge integration to eliminate attack surface
  • Educate users about the risk of clicking links within pull request bodies in GitButler
  • Monitor for suspicious pull request activity in integrated forges
  • Review application logs for unexpected script execution or network activity from the GitButler webview process

Evidence notes

Vulnerability confirmed through GitHub Security Advisory GHSA-xpmj-536r-9fc6. CVSS 4.0 score of 9.3 reflects critical severity with high impacts across all security dimensions. Fix version 0.19.7 explicitly addresses this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45261 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45261

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45261 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45261

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.