CVE-2018-5226

—

CVSS 3.0

8.8 high

EPSS

1%p72

Published

Apr 25, 2018 (Apr 25, 2018)

Modified

Jun 17, 2026

Description

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. All versions of Sourcetree for Windows before 2.5.5.0 are affected by this vulnerability.

Vendors: atlassian
Products: sourcetree
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.