CVE-2018-5226

8.8 highEPSS 1.4%

High (8.8) in atlassian sourcetree. EPSS 1.4% chance of exploitation in the next 30 days.

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. All versions of Sourcetree for Windows before 2.5.5.0 are affected by this vulnerability.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
Published: 2018-04-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:sourcetree

References

https://jira.atlassian.com/browse/SRCTREEWIN-8509
https://jira.atlassian.com/browse/SRCTREEWIN-8509

Check your stack JSON