What is CVE-2018-13386?

CVE-2018-13386 is a high-severity vulnerability in Atlassian Sourcetree, classified under Argument Injection. CVSS score: 8.1/10. Published 2018-07-24.

How severe is CVE-2018-13386?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Atlassian Sourcetree

CVE-2018-13386

There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for Windows before version 2.6.9 are affected by this vulnerability.

EPSS: 0.018 (76.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Atlassian Sourcetree
Atlassian Sourcetree For Windows — versions unspecified

Weakness classification (CWE)

CWE-88 — Argument Injection

References

security@atlassian.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-13386?: CVE-2018-13386 is a high-severity vulnerability in Atlassian Sourcetree, classified under Argument Injection. CVSS score: 8.1/10. Published 2018-07-24.
How severe is CVE-2018-13386?: High severity. CVSS v3 base score is 8.1 out of 10.