Read the docs
TI-2024-14406 Aliases CVE-2024-21697GHSA-v826-2933-8r2h

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions…

Priority MEDIUM 41Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Sourcetree for Mac 4.2: Upgrade to a release greater than or equal to 4.2.9 Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.20 See the release notes ([https://www.sourcetreeapp.com/download-archives]). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center ([https://www.sourcetreeapp.com/download-archives]). This vulnerability was reported via our Penetration Testing program.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00772 55th percentileScored 2026-11-07
Fix Fixed Sourcetree for Mac (Atlassian): All versions from 4.2.9Sourcetree for Windows (Atlassian): All versions from 3.4.20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianSourcetree for MacAll versions from 4.2.8 to 4.2.8All versions from 4.2.9Patch availableCNA
AtlassianSourcetree for WindowsAll versions from 3.4.19 to 3.4.19All versions from 3.4.20Patch availableCNA
  • Sourcetree for Mac VendorAtlassian Affected All versions from 4.2.8 to 4.2.8 Fixed in All versions from 4.2.9 Patch available CNA
  • Sourcetree for Windows VendorAtlassian Affected All versions from 3.4.19 to 3.4.19 Fixed in All versions from 3.4.20 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:sourcetree:3.4.19:*:*:*:*:windows:*:*3.4.19VulnerableAtlassian
cpe:2.3:a:atlassian:sourcetree:4.2.8:*:*:*:*:macos:*:*4.2.8VulnerableAtlassian
  • cpe:2.3:a:atlassian:sourcetree:3.4.19:*:*:*:*:windows:*:* Versions 3.4.19 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:sourcetree:4.2.8:*:*:*:*:macos:*:* Versions 4.2.8 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Sourcetree for Mac (Atlassian) Fixed in All versions from 4.2.9
  • Fix · CNA Sourcetree for Windows (Atlassian) Fixed in All versions from 3.4.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21697
  2. 2026-10-03 Alias added: GHSA-v826-2933-8r2h

References

Advisory 2

  • TI-2017-06280 Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling… CVSS 3.0CRITICAL 9.8
  • TI-2018-14342 There was an argument injection vulnerability in Atlassian Sourcetree for Windows from… CVSS 3.0HIGH 8.8
  • TI-2018-14343 Command injection in Atlassian Sourcetree for Windows CVSS 3.0HIGH 8.8
  • TI-2018-14341 There was an argument injection vulnerability in Atlassian Sourcetree for macOS from… CVSS 3.0HIGH 8.8
  • TI-2019-08655 An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers… CVSS 3.0HIGH 8.8
  • TI-2018-09622 There was an argument injection vulnerability in Sourcetree for macOS via filenames in… CVSS 3.0CRITICAL 9.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences