Atlassian Sourcetree EUVD-2026-46328

Exploitation requires the victim to be running Sourcetree for Mac or Sourcetree for Windows version 3.4.11 or 3.4.12 (not earlier or later versions). The CVSS vector confirms PR:L - a low-privilege authenticated context is required, consistent with the victim being a logged-in Sourcetree user. UI:R confirms user interaction is mandatory - passive network exposure is insufficient; the victim must actively open, clone, or otherwise process the attacker-controlled repository content within Sourcetree. Exploitation is limited to developer workstations with the affected application installed; server-side or headless environments are not impacted. The scope is unchanged (S:U), meaning a successful exploit does not inherently pivot to other systems beyond the compromised workstation session.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) scores 8.0 (High), though the advisory description cites 7.1 - a discrepancy; the vector mathematically resolves to 8.0, which is likely authoritative. The PR:L and UI:R modifiers are significant mitigating signals: exploitation is not fully unauthenticated and requires the victim to interact with attacker-controlled content. EPSS at 0.30% (22nd percentile) is low, indicating the security community does not currently observe high exploitation probability. There is no CISA KEV listing and no known public POC, reducing urgency compared to opportunistically exploited vulnerabilities. Despite the High CVSS, realistic attack surface is constrained to developer workstations running affected Sourcetree versions who open malicious repositories - making this a targeted rather than mass-exploitation risk profile. The tag 'Microsoft' in the intelligence feed is likely erroneous or refers to platform, not vendor; no Microsoft product involvement is indicated by the CVE data.

An attacker hosts a malicious Git repository containing a crafted payload - such as a manipulated submodule configuration, hook definition, or repository metadata - exploiting the code injection flaw. When a low-privileged Sourcetree user opens or interacts with this repository in an affected version (3.4.11 or 3.4.12), the injected code executes in the context of the local user's session, granting the attacker full control of the developer workstation. No public POC is known at time of analysis, but the network delivery vector means the malicious repository could be shared via pull request, link, or social engineering.