PT-2019-10027

Name of the Vulnerable Software and Affected Versions: Atlassian Sourcetree for macOS versions 1.2 through 3.1.1 Description: The issue allows a remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS to exploit an argument injection vulnerability via...

CVE-2018-13396

CVE-2018-13396 affects Sourcetree for macOS. The vulnerability is an argument injection in the embedded Git used by Sourcetree when parsing Git subrepositories in Mercurial repositories. A user with write access to a Mercurial repo linked in Sourcetree can exploit this to execute code on the syst...

PT-2018-11798

Name of the Vulnerable Software and Affected Versions Sourcetree for macOS versions 1.0b2 through 2.x Description The issue allows an attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS to exploit an argument injection vulnerability via Git subrepositories ...

CVE-2018-13385: Improper Neutralization of Argument Delimiters in a Command

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree...

PT-2018-11786

Name of the Vulnerable Software and Affected Versions Sourcetree for macOS versions 1.0b2 through 2.7.6 Description The issue is related to an argument injection vulnerability in Sourcetree for macOS, specifically via filenames in Mercurial repositories. An attacker who has permission to commit t...

PT-2018-5684

Name of the Vulnerable Software and Affected Versions: Sourcetree for macOS versions 1.0b2 through 2.7.0 Description: The issue affects the handling of Mercurial and Git repositories in Sourcetree for macOS, allowing an attacker with commit permission to a linked repository to exploit argument an...

CVE-2017-14592: Improper Neutralization of Special Elements used in a Command

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree...

Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

The embedded version of Git LFS|https://git-lfs.github.com used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing...