CVE-2018-20235

There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.

• http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html
• http://www.securityfocus.com/bid/107407Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/SRCTREEWIN-11289Issue Tracking, Vendor Advisory
• https://seclists.org/bugtraq/2019/Mar/30
• http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html
• http://www.securityfocus.com/bid/107407Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/SRCTREEWIN-11289Issue Tracking, Vendor Advisory
• https://seclists.org/bugtraq/2019/Mar/30

Published

Mar 8, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20229GitLab Community and Enterprise Edition before 11.3.14, 11.4…
• CVE-2018-20230An issue was discovered in PSPP 1.2.0. There is a heap-based…
• CVE-2018-20231Cross Site Request Forgery (CSRF) in the two-factor-authenti…
• CVE-2018-20232The labels widget gadget in Atlassian Jira before version 7.…
• CVE-2018-20233The Upload add-on resource in Atlassian Universal Plugin Man…
• CVE-2018-20234There was an argument injection vulnerability in Atlassian S…
• CVE-2018-20236There was an command injection vulnerability in Sourcetree f…
• CVE-2018-20237Atlassian Confluence Server and Data Center before version 6…6.5
• CVE-2018-20238Various rest resources in Atlassian Crowd before version 3.2…
• CVE-2018-20239Application Links before version 5.0.11, from version 5.1.0 …5.4
• CVE-2018-2024IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a secu…8.1
• CVE-2018-20240The administrative linker functionality in Atlassian Fisheye…