Read the docs
TI-2023-08756 Aliases CVE-2023-22514GHSA-hjgh-vh3c-8rg8

Code injection in Atlassian Sourcetree for Mac

Priority LOW 36CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.8, and a CVSS Vector of: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H which allows an unauthenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.15 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Penetration Testing program.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00422 36th percentileScored 2026-11-07
Fix Fixed Sourcetree for Mac (Atlassian): < 3.4.14, >= 3.4.15Sourcetree for Windows (Atlassian): < 3.4.14, >= 3.4.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianSourcetree for Mac>= 3.4.14< 3.4.14, >= 3.4.15Patch availableCNA
AtlassianSourcetree for Windows>= 3.4.14< 3.4.14, >= 3.4.15Patch availableCNA
  • Sourcetree for Mac VendorAtlassian Affected >= 3.4.14 Fixed in < 3.4.14, >= 3.4.15 Patch available CNA
  • Sourcetree for Windows VendorAtlassian Affected >= 3.4.14 Fixed in < 3.4.14, >= 3.4.15 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:windows:*:*3.4.0 to before 3.4.15VulnerableAtlassian
cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:macos:*:*4.1.0 to before 4.2.5VulnerableAtlassian
  • cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:windows:*:* Versions 3.4.0 to before 3.4.15 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:macos:*:* Versions 4.1.0 to before 4.2.5 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Sourcetree for Mac (Atlassian) Fixed in < 3.4.14, >= 3.4.15
  • Fix · CNA Sourcetree for Windows (Atlassian) Fixed in < 3.4.14, >= 3.4.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22514
  2. 2026-10-03 Alias added: GHSA-hjgh-vh3c-8rg8

References

Advisory 2

  • TI-2017-06280 Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling… CVSS 3.0CRITICAL 9.8
  • TI-2018-14342 There was an argument injection vulnerability in Atlassian Sourcetree for Windows from… CVSS 3.0HIGH 8.8
  • TI-2018-14343 Command injection in Atlassian Sourcetree for Windows CVSS 3.0HIGH 8.8
  • TI-2018-14341 There was an argument injection vulnerability in Atlassian Sourcetree for macOS from… CVSS 3.0HIGH 8.8
  • TI-2019-08655 An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers… CVSS 3.0HIGH 8.8
  • TI-2018-09622 There was an argument injection vulnerability in Sourcetree for macOS via filenames in… CVSS 3.0CRITICAL 9.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences