# CVE-2026-21575: Atlassian Sourcetree remote code execution

Source: https://junglewise.ai/threats/cve-2026-21575-atlassian-sourcetree-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-21575 · Severity: high · CVSS 7.1 · Published 2026-07-21

Atlassian Sourcetree, a popular desktop application for managing Git repositories, is affected by a security flaw that could allow an attacker to take control of a user's computer. By tricking a logged-in user into performing a specific action, an attacker could execute malicious commands, potentially leading to data theft or full system compromise. Users are advised to update to version 3.4.13 or later to resolve this issue.

Vendors: [Atlassian](https://junglewise.ai/threats/vendors/atlassian).

## Quick answers

**Is CVE-2026-21575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21575 being exploited in the wild.

**How severe is CVE-2026-21575?** High severity, with a CVSS score of 7.1, published 21 July 2026.

**Which products and versions are affected?** Atlassian Sourcetree 3.4.11 to 3.4.12.

**Is there a fix for CVE-2026-21575?** A patch was published on 2026-07-21: Fixed in version 3.4.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21575 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-21575?** Check whether you run Atlassian Sourcetree at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Remote Code Execution (RCE) vulnerability exists in Atlassian Sourcetree for Mac and Windows versions 3.4.11 and 3.4.12. The flaw allows an authenticated attacker to execute arbitrary code on the host system, though the attack requires high complexity and specific user interaction (UI:R). The vulnerability was identified through Atlassian's Bug Bounty program and carries a CVSS score of 7.1. The issue is resolved in Sourcetree version 3.4.13 and all subsequent releases.

## Affected products

- Atlassian Sourcetree for Mac 3.4.11 to 3.4.12
- Atlassian Sourcetree for Windows 3.4.11 to 3.4.12

## Timeline

- 2026-07-07: disclosed: Vulnerability reported via Bug Bounty program
- 2026-07-21: advisory: Official Atlassian security bulletin published
- 2026-07-21: patched: Fixed in version 3.4.13

## References

- [https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345](https://confluence.atlassian.com/pages/viewpage.action?pageId=1821999345)
- [https://jira.atlassian.com/browse/SRCTREE-8275](https://jira.atlassian.com/browse/SRCTREE-8275)