SourceTree for Mac had a shell injection vulnerability starting with 1.9.8 prior to 2.3.1 (the fixed version). By visiting a malicious website or by convincing a user to click a sourcetree:// URL with a vulnerable version of SourceTree for Mac installed an attacker could use a shell injection vulnerability to execute arbitrary commands on a victims machine.
Affected versions: * All versions of SourceTree for Mac from 1.9.8 before 2.3.1 (the fixed version) are affected by this vulnerability.
h4. Fix: * SourceTree for Mac version 2.3.2 is available for download from [https://www.sourcetreeapp.com/?v=mac.|https://www.sourcetreeapp.com/?v=mac]
We would like to credit Matthew Diaz of NCC Group Security Advisory for reporting this issue to us.