CVE-2026-45261: GitButler: Link injection via forge integration enables arbitrary script execution

Synopsis

This is a link-injection vulnerability in the Tauri-based GitButler desktop application that leads to arbitrary script execution (remote code execution). An attacker with a low-privilege account injects a malicious link into a pull request body; if a victim clicks that link inside the GitButler interface, the Tauri webview executes arbitrary scripts without further restriction. Successful exploitation gives the attacker full read, write, and availability impact on both the local and any connected system scope. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the malicious pull request link over the network to a target GitButler instance with forge integration enabled.

• AuthenticationRequired

  The attacker needs at least a low-privilege account sufficient to open or comment on a pull request and inject the malicious link.

• Victim interactionRequired

  A victim must actively click the injected link inside the GitButler interface for the Tauri webview to execute the malicious script.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special environmental factors are required beyond the victim having forge integration enabled.

Blast Radius

• The attacker executes arbitrary scripts inside the Tauri webview, giving full code execution on the victim's local machine.
• Confidential data accessible to the desktop application, including repository contents, credentials, and session tokens, is readable by the attacker.
• The attacker can write or modify files and repository state on the victim's machine.
• Because CVSS v4.0 subsequent-system impact is also rated High across all dimensions, any networked resources the victim's machine has access to are reachable for further read, write, or disruption actions.