CVE-2026-21575: Sourcetree RCE Vulnerability

CVE-2026-21575 Overview

CVE-2026-21575 is a remote code execution (RCE) vulnerability affecting Atlassian Sourcetree for Mac and Sourcetree for Windows. The flaw was introduced in version 3.4.11 and is classified under CWE-94 Improper Control of Generation of Code. An authenticated attacker can execute arbitrary code when a user is convinced to interact with malicious content. Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected workstation. Atlassian received the report through its public Bug Bounty program and has released fixed builds through the standard download channel.

Critical Impact
An authenticated attacker who convinces a user to interact with crafted content can execute arbitrary code on the developer workstation, compromising source code, credentials, and downstream Git repositories.

Affected Products

Sourcetree for Mac versions 3.4.11 through releases prior to 3.4.13
Sourcetree for Windows versions 3.4.11 through releases prior to 3.4.13
Any Atlassian Sourcetree 3.4.x deployment introduced from version 3.4.11

Discovery Timeline

2026-07-21 - CVE-2026-21575 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database
Reported to Atlassian through the Atlassian Bug Bounty program

Technical Details for CVE-2026-21575

Vulnerability Analysis

CVE-2026-21575 is a Remote Code Execution vulnerability rooted in improper control of code generation, mapped to [CWE-94]. Sourcetree is a Git and Mercurial desktop client used by developers to manage local and remote repositories. The vulnerability was introduced in version 3.4.11 and persists until version 3.4.13. Because Sourcetree operates on repository metadata and executes helper tooling on behalf of the user, code-generation flaws inside the client can translate directly into arbitrary command execution in the developer's user context. Once code executes on a developer machine, attackers can pivot to source repositories, signing keys, cloud credentials stored in the OS keychain, and CI/CD tokens.

Root Cause

The root cause is improper control of code generation ([CWE-94]) within Sourcetree client logic. Untrusted input processed by the application is incorporated into a code or command construction path without sufficient neutralization, permitting attacker-controlled content to be interpreted as executable instructions rather than data.

Attack Vector

The attack vector is network-based but requires both low-privilege authentication and user interaction. A realistic exploitation chain involves an attacker hosting or contributing a crafted repository, submodule, hook, or configuration artifact that a Sourcetree user clones, opens, or refreshes. When the user performs the interaction, the malicious payload is processed by the vulnerable code path and executed on the workstation. The high attack complexity indicates that specific conditions must be met for the exploit to succeed. No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Atlassian advisory (SRCTREE-8275) and the Atlassian Confluence page for vendor technical details.

Detection Methods for CVE-2026-21575

Indicators of Compromise

Sourcetree client versions between 3.4.11 and 3.4.12 present in the endpoint software inventory
Sourcetree parent process (SourceTree.exe on Windows, Sourcetree on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, bash, osascript, or script interpreters
Outbound network connections initiated by Sourcetree to non-Git hosts shortly after a clone, fetch, or repository open action
Newly created files or scheduled tasks written under user profile directories immediately after Sourcetree activity

Detection Strategies

Inventory endpoints for vulnerable Sourcetree builds using EDR software asset queries and flag any version below 3.4.13
Alert on anomalous child processes launched by the Sourcetree binary, especially interactive shells or LOLBins
Correlate Git operations with process, file, and network telemetry to identify repository actions that trigger execution
Monitor cloning of repositories from untrusted or newly registered domains by developer accounts

Monitoring Recommendations

Ingest endpoint process and file telemetry into a centralized data lake and retain developer workstation activity for extended review windows
Baseline normal Sourcetree behavior per user, then alert on deviations such as unusual command-line arguments or persistence artifacts
Track authentication and token usage from developer machines against Git hosting providers to identify post-exploitation repository access

How to Mitigate CVE-2026-21575

Immediate Actions Required

Upgrade Sourcetree for Mac and Sourcetree for Windows to version 3.4.13 or later from the Sourcetree download archives
Identify all developer endpoints running Sourcetree 3.4.11 or 3.4.12 and prioritize patch deployment
Rotate credentials, SSH keys, and personal access tokens on any workstation suspected of processing untrusted repositories while unpatched
Restrict cloning of repositories from untrusted sources until upgrades complete

Patch Information

Atlassian has released Sourcetree 3.4.13 for both Mac and Windows to remediate CVE-2026-21575. Customers on the 3.4 branch should upgrade to any release greater than or equal to 3.4.13. Refer to the Atlassian Confluence advisory and SRCTREE-8275 for release notes and fixed version details.

Workarounds

No official workaround has been published by Atlassian; upgrading to a fixed version is the required remediation
As a compensating control, restrict Sourcetree usage to repositories hosted on trusted internal or vetted external Git servers
Enforce application allowlisting policies that block Sourcetree from launching unexpected interpreters and shells
Require developers to review submodules, hooks, and repository configuration files before opening untrusted projects