CVE-2017-14592

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree for macOS, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler. Versions of Sourcetree for macOS starting with 1.0b2 before version 2.7.0 are affected by this vulnerability.

• CWE-77

• http://www.securityfocus.com/bid/102926Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.htmlThird Party Advisory
• https://jira.atlassian.com/browse/SRCTREE-5243Third Party Advisory
• http://www.securityfocus.com/bid/102926Third Party Advisory, VDB Entry
• https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.htmlThird Party Advisory
• https://jira.atlassian.com/browse/SRCTREE-5243Third Party Advisory

Published

Jan 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14587The administration user deletion resource in Atlassian Fishe…
• CVE-2017-14588Various resources in Atlassian Fisheye and Crucible before v…
• CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker tem…
• CVE-2017-1459IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specif…
• CVE-2017-14590Bamboo did not check that the name of a branch in a Mercuria…
• CVE-2017-14591Atlassian Fisheye and Crucible versions less than 4.4.3 and …
• CVE-2017-14593Sourcetree for Windows had several argument and command inje…
• CVE-2017-14594The printable searchrequest issue resource in Atlassian Jira…
• CVE-2017-14595In Joomla! before 3.8.0, a logic bug in a SQL query could le…
• CVE-2017-14596In Joomla! before 3.8.0, inadequate escaping in the LDAP aut…
• CVE-2017-14597AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XS…
• CVE-2017-1460IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue…