Atlassian Sourcetree vulnerabilities

16 CVEs affecting Atlassian Sourcetree, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21575, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-8768, published 2017-05-04. Critical severity, CVSS 9.8. EPSS: 8.3% chance of exploitation in the next 30 days. Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of…
CVE-2018-20235, published 2019-03-08. High severity, CVSS 8.8. EPSS: 6.7% chance of exploitation in the next 30 days. There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories. A remote attacker with permission to…
CVE-2018-20236, published 2019-03-08. High severity, CVSS 8.8. EPSS: 6.4% chance of exploitation in the next 30 days. There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using…
CVE-2018-20234, published 2019-03-08. High severity, CVSS 8.8. EPSS: 5.9% chance of exploitation in the next 30 days. There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories. A remote attacker with permission to…
CVE-2017-14593, published 2018-01-26. High severity, CVSS 8.8. EPSS: 5.5% chance of exploitation in the next 30 days. Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows…
CVE-2017-14592, published 2018-01-26. High severity, CVSS 8.8. EPSS: 5.5% chance of exploitation in the next 30 days. Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is…
CVE-2019-11582, published 2019-06-14. High severity, CVSS 8.8. EPSS: 4.9% chance of exploitation in the next 30 days. An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a…
CVE-2018-13385, published 2018-07-24. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for…
CVE-2018-13397, published 2018-11-05. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to…
CVE-2018-13396, published 2018-11-05. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit…

Latest

CVE-2026-21575, published 2026-07-21. High severity, CVSS 8.0. EPSS: 0.6% chance of exploitation in the next 30 days. This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability,…
CVE-2025-22165, published 2025-07-24. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9,…
CVE-2024-21697, published 2024-11-19. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows. This RCE (Remote Code Execution)…
CVE-2023-22514, published 2024-01-16. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability,…