CVE-2018-20236: Atlassian Sourcetree

High severity, CVSS 8.8. EPSS: 6.4% chance of exploitation in the next 30 days.

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system.

Affected products

• Atlassian Sourcetree: from 0.5a, before 3.0.10 (fixed in 3.0.10)

Published 2019-03-08. Last modified 2026-06-17.