What is CVE-2018-5226?

CVE-2018-5226 is a high-severity vulnerability in Atlassian Sourcetree. CVSS score: 8.8/10. Published 2018-04-25.

How severe is CVE-2018-5226?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Atlassian Sourcetree

CVE-2018-5226

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. All versions of Sourcetree for Windows before 2.5.5.0 are affected by this vulnerability.

EPSS: 0.013 (67.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Atlassian Sourcetree
Atlassian Sourcetree Windows — versions unspecified

References

security@atlassian.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-5226?: CVE-2018-5226 is a high-severity vulnerability in Atlassian Sourcetree. CVSS score: 8.8/10. Published 2018-04-25.
How severe is CVE-2018-5226?: High severity. CVSS v3 base score is 8.8 out of 10.