CVE-2026-21575: RCE (Remote Code Execution) in Atlassian Sourcetree for Mac
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Bug Bounty program.
AI Analysis
Technical Summary
This vulnerability in Atlassian Sourcetree for Mac and Windows was introduced in version 3.4.11 and allows an authenticated attacker to execute arbitrary code remotely. The CVSS v3.0 score is 7.1, indicating high severity with network attack vector, high attack complexity, low privileges required, and user interaction needed. The impact is high on confidentiality, integrity, and availability. Atlassian advises upgrading to version 3.4.13 or later to address the issue.
Potential Impact
An authenticated attacker who can induce user interaction may execute arbitrary code on the affected system, potentially compromising confidentiality, integrity, and availability of the system running Sourcetree for Mac or Windows versions 3.4.11 and 3.4.12.
Mitigation Recommendations
Atlassian recommends upgrading Sourcetree for Mac and Windows to version 3.4.13 or later. If upgrading immediately is not possible, users should apply the fixed versions as specified by Atlassian. No other mitigation or temporary workaround is provided in the advisory.
CVE-2026-21575: RCE (Remote Code Execution) in Atlassian Sourcetree for Mac
Description
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Bug Bounty program.
CVSS v3.0
Score 7.1high
Affected software
pkg:github/atlassian/sourcetreeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Atlassian Sourcetree for Mac and Windows was introduced in version 3.4.11 and allows an authenticated attacker to execute arbitrary code remotely. The CVSS v3.0 score is 7.1, indicating high severity with network attack vector, high attack complexity, low privileges required, and user interaction needed. The impact is high on confidentiality, integrity, and availability. Atlassian advises upgrading to version 3.4.13 or later to address the issue.
Potential Impact
An authenticated attacker who can induce user interaction may execute arbitrary code on the affected system, potentially compromising confidentiality, integrity, and availability of the system running Sourcetree for Mac or Windows versions 3.4.11 and 3.4.12.
Mitigation Recommendations
Atlassian recommends upgrading Sourcetree for Mac and Windows to version 3.4.13 or later. If upgrading immediately is not possible, users should apply the fixed versions as specified by Atlassian. No other mitigation or temporary workaround is provided in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- atlassian
- Date Reserved
- 2026-01-01T00:00:40.720Z
- Cvss Version
- 3.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5faf7c2a4a8d59898322a3
Added to database: 07/21/2026, 17:42:20 UTC
Last enriched: 07/21/2026, 17:58:01 UTC
Last updated: 07/21/2026, 21:11:17 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.