CVE-2018-13396

There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.

Score

CVSS 3.0 8.8 High

Status

Modified - security@atlassian.com

Published

2018-11-05

Last modified

2024-09-16

Affected products

• Sourcetree (Atlassian)
• Sourcetree For Macos (Atlassian)

References

• https://jira.atlassian.com/browse/SRCTREE-5985