CVE-2025-22165: Atlassian Sourcetree RCE Vulnerability

CVE-2025-22165 Overview

CVE-2025-22165 is an Arbitrary Code Execution (ACE) vulnerability affecting Atlassian Sourcetree for Mac. The flaw was introduced in version 4.2.8 and allows a locally authenticated attacker to execute arbitrary code on the host. Exploitation requires user interaction but yields high impact on confidentiality, integrity, and availability of the affected system. The weakness maps to [CWE-269] (Improper Privilege Management). Atlassian confirmed the issue through its Bug Bounty Program, with the finding attributed to Karol Mazurek of AFINE.

Critical Impact
A local attacker with low privileges can execute arbitrary code on macOS hosts running vulnerable Sourcetree builds, compromising developer workstations and any Git repositories or credentials accessible to them.

Affected Products

Atlassian Sourcetree for Mac version 4.2.8
Atlassian Sourcetree for Mac versions later than 4.2.8 prior to the fixed release
macOS installations only (Windows builds are not listed as affected)

Discovery Timeline

2025-07-24 - CVE-2025-22165 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22165

Vulnerability Analysis

CVE-2025-22165 is classified as Arbitrary Code Execution stemming from Improper Privilege Management [CWE-269] in Sourcetree for Mac. A locally authenticated user can trigger a code path that executes attacker-controlled code within the context of the Sourcetree application. Because Sourcetree handles Git operations, SSH keys, and repository hooks, code executed through the application can access sensitive developer assets. The current EPSS probability indicates a low likelihood of near-term opportunistic exploitation, but targeted abuse against developer workstations remains plausible.

Root Cause

Atlassian has not published low-level technical details in the public advisory. The Common Weakness Enumeration mapping to [CWE-269] indicates the flaw involves improper handling of privileges within the application, allowing an authenticated local user to perform actions that escape the intended trust boundary. Refer to the Atlassian JIRA Issue SRCTREE-8217 for the vendor tracking record.

Attack Vector

The attack vector is local and requires user interaction. An attacker must have low-privileged authenticated access to the macOS host and must induce the Sourcetree user to perform an action that triggers the vulnerable code path. Successful exploitation results in arbitrary code execution with the privileges of the Sourcetree process, which typically runs as the interactive desktop user. No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities listing exists for this issue at the time of writing.

Detection Methods for CVE-2025-22165

Indicators of Compromise

Unexpected child processes spawned by Sourcetree.app or its embedded Git binaries, particularly shell interpreters such as /bin/bash, /bin/zsh, or osascript.
Newly created or modified files under ~/Library/Application Support/SourceTree/ and unexpected changes to repository hooks/ directories.
Outbound network connections originating from the Sourcetree process to non-Git hosts.

Detection Strategies

Inventory macOS endpoints to identify installations of Sourcetree at or above version 4.2.8 that predate the fixed release.
Monitor process lineage for Sourcetree spawning interpreters, compilers, or persistence utilities such as launchctl and crontab.
Correlate developer workstation telemetry with Git repository server logs to flag anomalous clone, push, or hook activity.

Monitoring Recommendations

Enable macOS Endpoint Security framework telemetry to capture process execution, file modification, and code-signing events for Sourcetree.
Alert on modifications to Git pre-commit, post-checkout, and post-merge hooks that were not initiated by the developer.
Track credential access to macOS Keychain items associated with source control services following Sourcetree activity.

How to Mitigate CVE-2025-22165

Immediate Actions Required

Upgrade Sourcetree for Mac to the latest version available from the Sourcetree download archives.
Identify and inventory all macOS hosts running Sourcetree 4.2.8 or later prior to the fixed release.
Restrict local access to developer workstations and enforce least-privilege on shared macOS systems.

Patch Information

Atlassian recommends upgrading Sourcetree for Mac to the latest version, or to one of the specified supported fixed versions listed in the Sourcetree release notes. Tracking for the fix is available in the vendor advisory Atlassian JIRA Issue SRCTREE-8217.

Workarounds

If immediate patching is not feasible, remove Sourcetree from affected macOS hosts and use an alternative Git client until the upgrade can be applied.
Limit interactive logon on developer workstations to trusted users and require multi-factor authentication for local accounts.
Educate users to avoid opening untrusted repositories or performing Sourcetree actions initiated by unverified sources, since exploitation requires user interaction.

bash

# Verify installed Sourcetree version on macOS
/usr/bin/defaults read /Applications/Sourcetree.app/Contents/Info.plist CFBundleShortVersionString

# Remove a vulnerable installation prior to reinstalling the patched build
sudo rm -rf /Applications/Sourcetree.app