CVE-2018-13396

CVE-2018-13396 affects Sourcetree for macOS. The vulnerability is an argument injection in the embedded Git used by Sourcetree when parsing Git subrepositories in Mercurial repositories. A user with write access to a Mercurial repo linked in Sourcetree can exploit this to execute code on the syst...

Git LFS: Arbitrary command execution in repositories with Git LFS enabled - CVE-2017-17831

The embedded version of Git LFS|https://git-lfs.github.com used in Sourcetree for macOS was vulnerable to CVE-2017-17831. An attacker can exploit this issue if they can commit to a git repository linked in Sourcetree for macOS by adding a .lfsconfig file containing a malicious lfs url, allowing...