Shell Injection in SourceTree for Mac

Type atlassian
Reporter dblack
Modified 2019-01-14T20:25:44


SourceTree for Mac had a shell injection vulnerability starting with 1.9.8 prior to 2.3.1 (the fixed version). By visiting a malicious website or by convincing a user to click a sourcetree:// URL with a vulnerable version of SourceTree for Mac installed an attacker could use a shell injection vulnerability to execute arbitrary commands on a victims machine.

Affected versions: * All versions of SourceTree for Mac from 1.9.8 before 2.3.1 (the fixed version) are affected by this vulnerability. 

h4. Fix: * SourceTree for Mac version 2.3.2 is available for download from [|]


We would like to credit Matthew Diaz of NCC Group Security Advisory for reporting this issue to us.