Read the docs
TI-2025-16101 Aliases CVE-2025-22165GHSA-g98p-wqr8-r32r

Improper privilege management in Atlassian Sourcetree for Mac

Priority LOW 28CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.  Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives . You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives . This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed Sourcetree for Mac (Atlassian): All versions from 4.2.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianSourcetree for MacAll versions from 4.2.8 to 4.2.11 inclusiveAll versions from 4.2.12Patch availableCNA
  • Sourcetree for Mac VendorAtlassian Affected All versions from 4.2.8 to 4.2.11 inclusive Fixed in All versions from 4.2.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:macos:*:*4.2.8 – 4.2.12VulnerableAtlassian
  • cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:macos:*:* Versions 4.2.8 – 4.2.12 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Sourcetree for Mac (Atlassian) Fixed in All versions from 4.2.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22165
  2. 2026-10-03 Alias added: GHSA-g98p-wqr8-r32r

References

Advisory 1

  • TI-2017-06280 Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling… CVSS 3.0CRITICAL 9.8
  • TI-2018-14342 There was an argument injection vulnerability in Atlassian Sourcetree for Windows from… CVSS 3.0HIGH 8.8
  • TI-2018-14343 Command injection in Atlassian Sourcetree for Windows CVSS 3.0HIGH 8.8
  • TI-2018-14341 There was an argument injection vulnerability in Atlassian Sourcetree for macOS from… CVSS 3.0HIGH 8.8
  • TI-2019-08655 An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers… CVSS 3.0HIGH 8.8
  • TI-2018-09622 There was an argument injection vulnerability in Sourcetree for macOS via filenames in… CVSS 3.0CRITICAL 9.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences