Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling.

Published 8 y ago 2018-01-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

5.5%

percentile 93%

Public exploits

none known

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree for macOS, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler. Versions of Sourcetree for macOS starting with 1.0b2 before version 2.7.0 are affected by this vulnerability.

Exploit prediction (EPSS)

5.52% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	9.0	`AV:N/AC:L/Au:S/C:C/I:C/A:C`

Affected products

Atlassian Sourcetree for macOS

Classification

Weakness

CWE-77 Improper Neutralization of Special Elements used in a Command

References

jira.atlassian.com /browse/SRCTREE-5243 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/102926 · vdb-entry, x_refsource_BID, x_transferred
confluence.atlassian.com /sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-14592
NVD: CVE-2017-14592

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.