Atlassian Sourcetree for Mac Arbitrary Code Execution Vulnerability

A medium severity arbitrary code execution vulnerability has been identified in Atlassian Sourcetree for Mac, specifically in versions 4.2.8, 4.2.9, 4.2.10, and 4.2.11. This vulnerability allows a locally authenticated attacker to execute arbitrary code, with high impact on confidentiality, integrity, and availability. The issue requires user interaction and was discovered through the Atlassian Bug Bounty Program.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the user who is currently running Sourcetree.

Remediation

Users are advised to upgrade to Sourcetree for Mac version 4.2.12 or later, where the vulnerability has been fixed. Version 4.2.12 can be downloaded from the Atlassian product downloads site.