CVE-2018-20234: Atlassian Sourcetree

High severity, CVSS 8.8. EPSS: 5.9% chance of exploitation in the next 30 days.

There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.

Affected products

• Atlassian Sourcetree: from 1.2.0, before 3.1.1 (fixed in 3.1.1)

Published 2019-03-08. Last modified 2026-06-17.