Skip to main content

Sourcetree CVE-2018-13386

HIGH
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
2018-07-24 security@atlassian.com
Microsoft RCE Sourcetree
8.1
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 24, 2018 - 13:29 nvd
HIGH 8.1

DescriptionNVD

There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for Windows before version 2.6.9 are affected by this vulnerability.

AnalysisAI

There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-88. There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for Windows before version 2.6.9 are affected by this vulnerability. Affected products include: Atlassian Sourcetree. Version information: version 2.6.9.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Sourcetree

View all
CVE-2017-8768 CRITICAL
9.8 May 04

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. Ra
CVE-2018-13385 CRITICAL
9.8 Jul 24

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. Rated cri
CVE-2024-21697 HIGH
8.8 Nov 19

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and

CVE-2019-11582 HIGH
8.8 Jun 14

An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3,

CVE-2018-13397 HIGH
8.8 Nov 05

There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Gi
CVE-2018-13396 HIGH
8.8 Nov 05

There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git su
CVE-2018-5226 HIGH
8.8 Apr 25

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all
CVE-2016-10033 CRITICAL POC
9.8
CVE-2026-24061 CRITICAL POC
9.8
CVE-2025-57791 MEDIUM POC
6.9
CVE-2018-17456 CRITICAL POC
9.8
CVE-2018-19518 HIGH POC
7.5
CVE-2025-70327 CRITICAL POC
9.8
CVE-2020-5792 HIGH POC
7.2
CVE-2024-39930 CRITICAL POC
9.9

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2018-13386 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy