What is the CVSS score of EUVD-2026-46328?

EUVD-2026-46328 has a CVSS 3.0 base score of 7.1 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Atlassian Sourcetree are affected by EUVD-2026-46328?

Atlassian Sourcetree (Mac/Windows Git client) contains a remote code execution vulnerability (CVSS 7.1) affecting versions 3.4.11 and later, enabling arbitrary code execution on developer…

How to fix or mitigate EUVD-2026-46328?

Within 24 hours, inventory all Sourcetree installations across the organization (focus on versions 3.4.11 and later) and map usage by development team; communicate the vulnerability and associated risks to engineering leadership. Within 7 days, implement network and application-level controls restricting developer ability to clone from untrusted external repositories, enhance monitoring on developer workstations to detect anomalous process execution, and establish repository access policies requiring approval for external sources. Within 30 days, evaluate and execute migration to alternative Git clients (GitHub Desktop, GitKraken, or command-line Git) where feasible, or implement strict application whitelisting; establish regular contact with Atlassian support for patch ETA and coordinate transition plan with development teams.

Atlassian Sourcetree EUVD-2026-46328

| CVE-2026-21575 HIGH

Code Injection (CWE-94)

2026-07-21 atlassian

GHSA-rrh5-678c-6wj4

RCE Atlassian Microsoft Sourcetree For Mac Code Injection

7.1

CVSS 3.0 · Vendor: atlassian

Severity by source

Vendor (atlassian) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Client-side RCE triggered by a victim opening attacker-supplied repo content, so AV:N and UI:R with AC:H; attacker needs no target privileges (PR:N), yielding full C/I/A within the user's scope.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (atlassian).

CVSS VectorVendor: atlassian

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 18:00 vuln.today

CVE Published

Jul 21, 2026 - 17:00 cve.org

HIGH 7.1

DescriptionCVE.org

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.

Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:

Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13

See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives).

This vulnerability was reported via our Bug Bounty program.

AnalysisAI

Remote code execution in Atlassian Sourcetree for Mac and Windows (Git desktop client) lets an attacker run arbitrary code on a developer's workstation with full impact to confidentiality, integrity, and availability. The flaw was introduced in version 3.4.11 and requires the victim to interact with attacker-controlled content, making a malicious repository the likely trigger. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious Git repository

Delivery

Lure developer to clone/open it

Exploit

Sourcetree processes untrusted repo data

Execution

Trigger code execution flaw

Impact

Run arbitrary code as user

Access

Craft malicious Git repository

Delivery

Lure developer to clone/open it

Exploit

Sourcetree processes untrusted repo data

Execution

Trigger code execution flaw

Impact

Run arbitrary code as user

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to be running Sourcetree for Mac or Windows version 3.4.11 or 3.4.12 and to actively interact with attacker-controlled repository content (UI:R) - realistically cloning, opening, or refreshing a malicious repository - rather than any passive or fully remote trigger. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.0 vector CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H yields 7.1 (High): network-reachable but with high attack complexity, low privileges, and mandatory user interaction, tempered against full C/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious Git repository whose contents (e.g., specially formed metadata, submodule, or hook/config data) trigger code execution when processed by Sourcetree, then lures a developer into cloning or opening it via a shared link, pull request, or fork. When the victim interacts with the repository in a vulnerable 3.4.11/3.4.12 client, arbitrary code runs in their user context. …
Remediation	Vendor-released patch: upgrade Sourcetree for Mac and Sourcetree for Windows to 3.4.13 or later (Atlassian recommends moving to the latest available release). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Sourcetree installations across the organization (focus on versions 3.4.11 and later) and map usage by development team; communicate the vulnerability and associated risks to engineering leadership. …

Threat intelligence, references, and detailed analysis are available after sign-in.