What is the CVSS score of CVE-2026-21575?

CVE-2026-21575 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Atlassian Sourcetree are affected by CVE-2026-21575?

Atlassian Sourcetree 3.4.11-3.4.12 (Mac/Windows) contains a remote code execution vulnerability allowing authenticated attackers to execute arbitrary code on developer machines through malicious…

How to fix or mitigate CVE-2026-21575?

Within 24 hours, inventory all Sourcetree 3.4.11-3.4.12 installations across engineering teams and notify users to avoid processing repositories from untrusted external sources; restrict repository clone operations to approved internal sources only. Within 7 days, implement mandatory code review for any external repository content before cloning, disable Sourcetree automation features that could trigger code execution paths, and deploy endpoint detection monitoring to flag suspicious child processes spawned from Sourcetree. Within 30 days, enforce upgrade to Sourcetree 3.4.13 or later when available (establish weekly monitoring of Atlassian security advisories); if upgrade is blocked, restrict affected users to air-gapped development workstations without network access to production infrastructure and implement network segmentation to prevent lateral movement.

Atlassian Sourcetree CVE-2026-21575

EUVD-2026-46328 HIGH

Code Injection (CWE-94)

2026-07-21 atlassian

GHSA-rrh5-678c-6wj4

RCE Microsoft Code Injection Atlassian Sourcetree For Mac

8.0

CVSS 3.1 · NVD

Severity by source

Vendor (atlassian) PRIMARY

HIGH

qualitative

NVD

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network delivery via repository, low privilege (authenticated user), required interaction (opening repo); full triad impact on victim workstation, no scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (atlassian).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 20:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 20:52 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 20:52 NVD

7.1 (HIGH) 8.0 (HIGH)

Analysis Generated

Jul 21, 2026 - 18:00 vuln.today

CVE Published

Jul 21, 2026 - 17:00 cve.org

HIGH 7.1

DescriptionNVD

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.

Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13

See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives).

This vulnerability was reported via our Bug Bounty program.

AnalysisAI

Remote code execution in Atlassian Sourcetree for Mac and Windows 3.4.11-3.4.12 enables an authenticated attacker to execute arbitrary code on a victim's machine via code injection (CWE-94), achieving full confidentiality, integrity, and availability compromise. The attack requires low-privilege authentication and user interaction - consistent with a scenario where a victim opens or processes attacker-controlled repository content within the application. No public exploit identified at time of analysis; EPSS at 0.30% (22nd percentile) reflects low current exploitation probability, and the vulnerability was responsibly disclosed through Atlassian's Bug Bounty program rather than discovered in active exploitation.

Technical ContextAI

CWE-94 (Improper Control of Generation of Code - Code Injection) describes flaws where user-supplied input is interpreted as executable code rather than data. Sourcetree is a graphical Git and Mercurial client for Mac and Windows developed by Atlassian, enabling developers to manage repositories without command-line interaction. The affected CPE (cpe:2.3:a:atlassian:sourcetree_for_mac) covers the Mac variant, with Windows equivalently affected per the advisory. Code injection in a Git GUI client typically arises when repository metadata, commit messages, submodule configurations, or hook definitions are processed in a way that allows embedded code to be interpreted by the host system. The network attack vector (AV:N) suggests the malicious payload can be delivered via a remotely hosted repository.

RemediationAI

Vendor-released patch: Sourcetree for Mac and Sourcetree for Windows 3.4.13 or later. Atlassian recommends upgrading to the latest available release. Patched versions are available from the Atlassian download archives at https://www.sourcetreeapp.com/download-archives, which also hosts release notes for version history. No workarounds are documented by the vendor. If immediate upgrade is not possible, a compensating control is to prevent Sourcetree from opening repositories from untrusted sources - however, this requires user discipline and has no enforcement mechanism in the application itself. Restricting repository access to internal, trusted sources reduces the attack surface with minimal operational trade-off for most development teams.