Uploaded image for project: 'Sourcetree For Mac'
  1. Sourcetree For Mac
  2. SRCTREE-5985

Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo - CVE-2018-13396

    XMLWordPrintable

    Details

    • Symptom Severity:
      Severity 1 - Critical

      Description

      There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 before version 3.0.0, via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.

       

      For additional details, see the full advisory

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned
              Reporter:
              ablack@atlassian.com Anton Black
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: