External risk intelligence

GitButler Desktop Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-45261

GitButler is a desktop application used for version control workflows. It is not an internet-facing service, gateway, or network appliance. Exposure is limited to the end-user's local environment, and the vulnerability requires user interaction (clicking a link) within the local desktop application context, making public internet-wide reachability not applicable to this product type.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a remote code execution vulnerability in the GitButler desktop application, a tool used for Git-based version control. The issue could allow an attacker to execute arbitrary scripts if a user clicks a malicious link within a pull request. This vulnerability is not present for users who have not enabled forge integration.

Malicious links in pull requests can execute scripts.
Users may be vulnerable if they click malicious links.
Confirm relevance if GitButler's forge integration is used.

Attack Path

How an attacker could exploit the issue

An attacker could start by creating a malicious link within a pull request's description. If a user clicks this link within the GitButler desktop application, it could trigger arbitrary script execution within the application's webview, potentially leading to remote code execution if forge integration is enabled.

Requires a user to click a malicious link.
Vulnerable component: Tauri webview in the desktop app.
Risk: Arbitrary script execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could inject a malicious link into a pull request that, if clicked by a user, may execute arbitrary scripts within the application's webview. This risk is mitigated for users not utilizing forge integration.

Arbitrary script execution within the webview.
User interaction with a malicious link.
Compromised local application environment.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the GitButler desktop application, meaning ownership likely resides with endpoint security or device management teams. The first step is to identify all instances of the GitButler application, confirm if forge integration is enabled, and determine if any users have clicked malicious links.

Endpoint and security teams should own the issue.
Verify forge integration is not enabled.
Plan user-driven remediation and communication.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GitButler?

GitButler is a desktop-based version control interface designed to streamline Git workflows with AI-assisted features. It serves as a specialized client that developers use to manage code repositories and interact with remote hosting platforms, known as forges, through a visual desktop environment.

What does CVE-2026-45261 mean?

This CVE identifies a security weakness classified as CWE-94, or improper control of generation of code. In plain terms, it means the application can be tricked into running unauthorized instructions. For GitButler, this allows a malicious actor to execute scripts inside the application's webview component.

How is this vulnerability triggered?

An attacker initiates the vulnerability by embedding a malicious link within a pull request body. The exploit only triggers if a user manually clicks this link while using the GitButler desktop application. If you have not enabled forge integration, this specific execution path is not available to an attacker.

Is my installation at risk?

According to Halo Surface Signal, this is a desktop application rather than an internet-facing service. The risk is confined to your local environment and requires specific user interaction. You should consider the risk higher if you actively use forge integrations, as these connections are necessary for the vulnerability to be fully realized.

What should I do to address this?

First, identify all machines running the GitButler desktop application. Determine if users have enabled forge integration, as this is the primary factor for risk. The most effective step is to update your software to version 0.19.7 or later, which contains the fix for this issue.

References

github.com/gitbutlerapp/gitbutler/security/advisories/GHSA-xpmj-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.