VulnerabilityDeferred

CVE-2026-45261

Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application.

CRITICAL 9.3EPSS 0.52%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, a emote code execution vulnerability exists in the Tauri-based GitButler desktop application. An attacker can inject a malicious link in a pull request body, which if clicked by the user allows for arbitrary script execution in the Tauri webview. Users that have not enabled forge integration are not at risk. This vulnerability is fixed in 0.19.7.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.52% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-94
Source: security-advisories@github.com

References

https://github.com/gitbutlerapp/gitbutler/security/advisories/GHSA-xpmj-536r-9fc6

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.