Login Request a demo
SO
Product
Sourcetree
by Atlassian · last CVE Jul 21, 2026
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities16In the news0Timeline
Severity mix
Critical 2High 14Medium 0Low 0
Severity
All severities16Critical2High14Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Sourcetree to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-13385
9.8
2%
Jul 24
There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories
Affected: 1.0 before 2.7.6; 1.0; 1.0; 1.0; 1.0; 1.0
CVE-2017-8768
9.8
8%
May 4
Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme
Affected: through 2.5c
CVE-2024-21697
8.8
1%
Nov 19
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows
Affected: 3.4.19; 4.2.8
CVE-2019-11582
8.8
5%
Jun 14
An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution…
Affected: 0.5a before 3.1.3
CVE-2018-20234
8.8
6%
Mar 8
There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories
Affected: 1.2.0 before 3.1.1
CVE-2018-20235
8.8
7%
Mar 8
There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories
Affected: 0.5a before 3.0.15
CVE-2018-20236
8.8
6%
Mar 8
There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling
Affected: 0.5a before 3.0.10
CVE-2018-13397
8.8
2%
Nov 5
There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories
Affected: 0.5.1.0 before 3.0.0
CVE-2018-13396
8.8
2%
Nov 5
There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories
Affected: 1.0 before 3.0.0; 1.0; 1.0; 1.0; 1.0; 1.0
CVE-2018-5226
8.8
1%
Apr 25
There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted
Affected: before 2.5.5.0
CVE-2017-14593
8.8
6%
Jan 26
Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling
Affected: 0.5.1.0 before 2.4.7.0
CVE-2017-14592
8.8
6%
Jan 26
Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling
Affected: 1.0 before 2.7; 1.0; 1.0; 1.0; 1.0; 1.0
CVE-2018-13386
8.1
2%
Jul 24
There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories
Affected: before 2.6.9
CVE-2026-21575
8.0
1%
Jul 21
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows
Affected: 3.4.11 before 3.4.13; 3.4.11 before 3.4.13
CVE-2023-22514
7.8
0%
Jan 16
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows
Affected: 3.4.0 before 3.4.15; 4.1.0 before 4.2.5
CVE-2025-22165
7.3
0%
Jul 24
This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac
Affected: 4.2.8 through 4.2.12
Showing 16