CVE-2026-21575

Summary

CVE	CVE-2026-21575
State	PUBLISHED
Assigner	atlassian
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-07-21 18:16:57 UTC
Updated	2026-07-22 19:16:58 UTC
Description	This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Bug Bounty program.

Primary CVSS: v3.0 7.1 HIGH from [email protected]

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.002980000 probability, percentile 0.219760000 (date 2026-07-22)

Problem Types: CWE-94 | RCE (Remote Code Execution) | CWE-94 CWE-94 Improper Control of Generation of Code ('Code Injection')

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Secondary	7.1	HIGH	`CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H`
3.0	CNA	DECLARED	7.1	HIGH	`CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H`

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Source	Vendor	Product	Version	Platforms
CNA	Atlassian	Sourcetree For Mac	affected All versions from 3.4.11 to 3.4.12 inclusive	Not specified
CNA	Atlassian	Sourcetree For Mac	unaffected All versions from 3.4.13	Not specified

Reference	Source	Link	Tags
confluence.atlassian.com/pages/viewpage.action	[email protected]	confluence.atlassian.com
jira.atlassian.com/browse/SRCTREE-8275	[email protected]	jira.atlassian.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.