PT-2026-44412

CVE-2026-45261

Published

2026-05-28

Updated

2026-06-01

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions GitButler versions prior to 0.19.7

Description A remote code execution issue exists in the Tauri-based desktop application. An attacker can inject a malicious link into a pull request body; if a user clicks this link, it allows for arbitrary script execution within the Tauri webview. This issue only affects users who have enabled forge integration.

Recommendations Update to version 0.19.7. Disable forge integration to mitigate the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Grumpinout1

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers