Executive brief
GitButler is a desktop application used by developers to manage code changes and pull requests. A security flaw allows an attacker to execute malicious code on a user's computer if the user clicks a specially crafted link within a pull request description. This could lead to full system compromise, data theft, or unauthorized access to private code repositories.
Technical details
A remote code execution (RCE) vulnerability exists in the GitButler desktop application due to improper sanitization of pull request content within its Tauri-based webview. The flaw (CWE-94) allows an attacker to inject malicious links into a pull request body. When a user with 'forge integration' enabled clicks the link, it triggers arbitrary script execution within the context of the application's webview. Because Tauri applications often have bridge access to the underlying operating system, this can lead to full remote code execution. The vulnerability is fixed in version 0.19.7; users on older versions can mitigate the risk by disabling forge integration.
Affected products
- GitButler GitButler < 0.19.7
Timeline
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: NVD publication date