Vulnerabilities

TI-2026-17401 CVE-2026-21575 · GHSA-rrh5-678c-6wj4

Code injection in Atlassian Sourcetree for Mac

LOW 38

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00589 Published 2026-07-21 Fixed in All versions from 3.4.13 CWE-94

TI-2025-16101 CVE-2025-22165 · GHSA-g98p-wqr8-r32r

Improper privilege management in Atlassian Sourcetree for Mac

LOW 28

This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac.

CVSS 4.0MEDIUM 5.9 Local Low privileges User interaction EPSS 0.00157 Published 2025-07-24 Fixed in All versions from 4.2.12 CWE-269

TI-2023-08756 CVE-2023-22514 · GHSA-hjgh-vh3c-8rg8

Code injection in Atlassian Sourcetree for Mac

LOW 36

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00422 Published 2025-03-18 Fixed in < 3.4.14, >= 3.4.15 CWE-94

TI-2024-14406 CVE-2024-21697 · GHSA-v826-2933-8r2h

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions…

MEDIUM 41

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00772 Published 2024-11-19 Fixed in All versions from 4.2.9, All versions from 3.4.20

TI-2019-08655 CVE-2019-11582 · GHSA-9rhm-rvmr-h9q2

An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers…

MEDIUM 46

An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a crafted URI.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.04936 Published 2019-06-14 Fixed in 3.1.3 CWE-88

TI-2018-14343 CVE-2018-20236 · GHSA-52v2-8xvg-r55r

Command injection in Atlassian Sourcetree for Windows

MEDIUM 47

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0644 Published 2019-03-08 Fixed in 3.0.10 CWE-77

TI-2018-14342 CVE-2018-20235 · GHSA-4cvg-635c-j7v8

There was an argument injection vulnerability in Atlassian Sourcetree for Windows from…

MEDIUM 48

There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.06686 Published 2019-03-08 Fixed in 3.0.15

TI-2018-14341 CVE-2018-20234 · GHSA-4rhr-pw6c-jrf4

There was an argument injection vulnerability in Atlassian Sourcetree for macOS from…

MEDIUM 47

There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05912 Published 2019-03-08 Fixed in 3.1.1 CWE-88

TI-2018-09634 CVE-2018-13397 · GHSA-5jh9-6vv3-xc89

There was an argument injection vulnerability in Sourcetree for Windows from version…

MEDIUM 42

There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01946 Published 2018-11-05 Fixed in 3.0.0

TI-2018-09633 CVE-2018-13396 · GHSA-m9xm-c5p7-mr3h

There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2…

MEDIUM 42

There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01946 Published 2018-11-05 Fixed in 3.0.0

TI-2018-09623 CVE-2018-13386 · GHSA-qhw8-cj7p-3gxh

There was an argument injection vulnerability in Sourcetree for Windows via filenames in…

LOW 38

There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01591 Published 2018-07-24 Fixed in 2.6.9 CWE-88

TI-2018-09622 CVE-2018-13385 · GHSA-qmx8-jjxc-9jwh

There was an argument injection vulnerability in Sourcetree for macOS via filenames in…

MEDIUM 46

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02214 Published 2018-07-24 Fixed in 2.7.6 CWE-88

TI-2018-03783 CVE-2018-5226 · GHSA-4rr7-7xpx-xq3f

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial…

MEDIUM 41

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01435 Published 2018-04-25 Fixed in 2.5.5.0

TI-2017-10694 CVE-2017-14593 · GHSA-2h25-2cpj-6h2c

Command injection in Atlassian Sourcetree for Windows

MEDIUM 46

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05516 Published 2018-01-26 No fix listed CWE-77

TI-2017-10693 CVE-2017-14592 · GHSA-gpjg-fjjx-7625

Command injection in Atlassian Sourcetree for macOS

MEDIUM 46

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05516 Published 2018-01-26 No fix listed CWE-77

TI-2017-06280 CVE-2017-8768 · GHSA-pf5p-r5w7-3r8g

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling…

MEDIUM 53

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08262 Published 2017-05-04 No fix listed CWE-78

Vulnerabilities

Filters