Remote Code Execution Vulnerability in Sourcetree for Mac and Windows by Atlassian
CVE-2026-21575

7.1HIGH

Key Information:

Vendor

Atlassian
Status
Sourcetree For Mac
Vendor
CVE Published:
21 July 2026

What is CVE-2026-21575?

A Remote Code Execution vulnerability was identified in versions 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This flaw allows an authenticated attacker to execute arbitrary code, posing significant risks to confidentiality, integrity, and availability of the system. The attacker needs user interaction to exploit this vulnerability effectively. Users are strongly encouraged to upgrade their software to versions greater than or equal to 3.4.13 to mitigate this risk. Atlassian has released guidance on the necessary updates in their release notes and provides download access to the latest versions on their website.

Affected Version(s)

Sourcetree for Mac All versions from 3.4.11 to 3.4.12 inclusive

Sourcetree for Mac All versions from 3.4.13

References

https://confluence.atlassian.com/pages/viewpage.action?pa...
https://jira.atlassian.com/browse/SRCTREE-8275

CVSS V3.0

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.