Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-45261GitButler: Link injection via forge integration enables arbitrary script execution

Critical 9.3

In plain English

A critical-severity code injection in gitbutler from gitbutlerapp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 56.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.

Affected products (as reported)

Vendor	Product	Versions
gitbutlerapp	gitbutler	< 0.19.7

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/gitbutlerapp/gitbutler/security/advisories/GHSA-xpmj-536r-9fc6 x_refsource_CONFIRM