CVE-2018-5226: Command Injection
There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. All versions of Sourcetree for Windows before 2.5.5.0 are affected by this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5226?
CVE-2018-5226 has been classified as a high severity vulnerability due to its potential for code execution.
How do I fix CVE-2018-5226?
To mitigate CVE-2018-5226, users should upgrade to Atlassian Sourcetree version 2.5.5.0 or later.
Who is affected by CVE-2018-5226?
CVE-2018-5226 affects users of Atlassian Sourcetree for Windows versions prior to 2.5.5.0.
What can an attacker do with CVE-2018-5226?
An attacker exploiting CVE-2018-5226 can gain code execution by manipulating Mercurial repository tag names.
Is there a workaround for CVE-2018-5226?
There are no known workarounds for CVE-2018-5226; upgrading to a fixed version is recommended.