TI-2026-17401 Aliases CVE-2026-21575 GHSA-rrh5-678c-6wj4

Code injection in Atlassian Sourcetree for Mac

LOW 38CWE-94Published 2026-07-21 · Updated 2026-07-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Bug Bounty program.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00589 48th percentileScored 2026-11-07

Fix Fixed Sourcetree for Mac (Atlassian): All versions from 3.4.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Sourcetree for Mac	All versions from 3.4.11 to 3.4.12 inclusive	All versions from 3.4.13	Patch available	CNA

Sourcetree for Mac VendorAtlassian Affected All versions from 3.4.11 to 3.4.12 inclusive Fixed in All versions from 3.4.13 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:sourcetree::::::macos::*	3.4.11 to before 3.4.13	Vulnerable	Atlassian
cpe:2.3:a:atlassian:sourcetree::::::windows::*	3.4.11 to before 3.4.13	Vulnerable	Atlassian

cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:macos:*:* Versions 3.4.11 to before 3.4.13 Vulnerable ·Atlassian
cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:windows:*:* Versions 3.4.11 to before 3.4.13 Vulnerable ·Atlassian

Remediation

Fix · CNA Sourcetree for Mac (Atlassian) Fixed in All versions from 3.4.13

Timeline

2026-10-02 Threatist record created from CVE-2026-21575
2026-10-03 Alias added: GHSA-rrh5-678c-6wj4

References

Advisory 1

https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345

Other 1

https://jira.atlassian.com/browse/SRCTREE-8275

TI-2017-06280 Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling… CVSS 3.0CRITICAL 9.8
TI-2018-14342 There was an argument injection vulnerability in Atlassian Sourcetree for Windows from… CVSS 3.0HIGH 8.8
TI-2018-14343 Command injection in Atlassian Sourcetree for Windows CVSS 3.0HIGH 8.8
TI-2018-14341 There was an argument injection vulnerability in Atlassian Sourcetree for macOS from… CVSS 3.0HIGH 8.8
TI-2019-08655 An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers… CVSS 3.0HIGH 8.8
TI-2018-09622 There was an argument injection vulnerability in Sourcetree for macOS via filenames in… CVSS 3.0CRITICAL 9.8

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences