EUVD-2026-46328
GHSA-rrh5-678c-6wj4
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Client-side RCE triggered by a victim opening attacker-supplied repo content, so AV:N and UI:R with AC:H; attacker needs no target privileges (PR:N), yielding full C/I/A within the user's scope.
Primary rating from Vendor (atlassian).
CVSS VectorVendor: atlassian
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows.
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.
Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
- Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13
See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives).
This vulnerability was reported via our Bug Bounty program.
AnalysisAI
Remote code execution in Atlassian Sourcetree for Mac and Windows (Git desktop client) lets an attacker run arbitrary code on a developer's workstation with full impact to confidentiality, integrity, and availability. The flaw was introduced in version 3.4.11 and requires the victim to interact with attacker-controlled content, making a malicious repository the likely trigger. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Sourcetree for Mac or Windows version 3.4.11 or 3.4.12 and to actively interact with attacker-controlled repository content (UI:R) - realistically cloning, opening, or refreshing a malicious repository - rather than any passive or fully remote trigger. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H yields 7.1 (High): network-reachable but with high attack complexity, low privileges, and mandatory user interaction, tempered against full C/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Git repository whose contents (e.g., specially formed metadata, submodule, or hook/config data) trigger code execution when processed by Sourcetree, then lures a developer into cloning or opening it via a shared link, pull request, or fork. When the victim interacts with the repository in a vulnerable 3.4.11/3.4.12 client, arbitrary code runs in their user context. … |
| Remediation | Vendor-released patch: upgrade Sourcetree for Mac and Sourcetree for Windows to 3.4.13 or later (Atlassian recommends moving to the latest available release). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Sourcetree installations across the organization (focus on versions 3.4.11 and later) and map usage by development team; communicate the vulnerability and associated risks to engineering leadership. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today