CVE-2026-45261

Vulnerability

A remote code execution vulnerability exists in the Tauri-based GitButler desktop application prior to version 0.19.7. The flaw resides in the forge integration feature, where an attacker can inject a malicious link into a pull request body. If a user with forge integration enabled clicks the link, arbitrary script execution occurs within the Tauri webview [1].

Exploitation

An attacker must craft a pull request containing a specially crafted link and submit it to a repository accessible to the victim. The attacker does not require authentication on the victim's system but must have the ability to create pull requests (e.g., via a fork). Successful exploitation depends on the victim having forge integration enabled in GitButler and clicking the malicious link. No additional user interaction beyond the click is needed [1].

Impact

Successful exploitation grants the attacker arbitrary script execution in the context of the Tauri webview. This can escalate to full remote code execution on the victim's machine, depending on the webview's sandbox restrictions and the application's permissions. The attacker gains the ability to execute arbitrary commands, potentially compromising the integrity and confidentiality of the user's data [1].

Mitigation

The vulnerability is fixed in GitButler version 0.19.7. Users should upgrade to this version or later. As a workaround, users who do not require forge integration can disable it to eliminate the attack surface. No other mitigations are disclosed in the available reference [1].