LiveActive security incident?Get immediate response
CVE Record

CVE-2018-13397: There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version...

There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-13397 is a Sourcetree for Windows flaw that could let a repository committer trigger code execution on a user’s workstation. The risk is most relevant to developer environments using older Sourcetree versions with Mercurial repositories that include Git subrepositories.

Executive priority

Prioritize remediation for developer workstations because successful exploitation can execute code on endpoints that may hold source code, credentials, and release access. Urgency is highest where older Sourcetree versions and shared Mercurial repositories are still in use.

Technical view

The issue is an argument injection vulnerability in Sourcetree for Windows versions 0.5.1.0 before 3.0.0. The described trigger path involves Git subrepositories inside Mercurial repositories. A committer to a linked Mercurial repository could exploit it to execute code on the Sourcetree user’s system.

Likely exposure

Exposure is likely limited to Windows users running Sourcetree before 3.0.0 who open or track Mercurial repositories containing Git subrepositories. Teams not using Mercurial, not using Git subrepositories, or already on Sourcetree 3.0.0 or later are less likely exposed.

Exploitation context

The bundle does not show KEV listing or cited evidence of active exploitation. The known attacker prerequisite is permission to commit to a Mercurial repository linked in Sourcetree for Windows. That makes insider, compromised developer account, or compromised repository scenarios more relevant than unauthenticated internet exposure.

Researcher notes

Public details are sparse: no CVSS, CWE, or detailed advisory content is included in the bundle. The key facts are the affected version range, Windows-only product scope, Git subrepository-in-Mercurial trigger context, committer prerequisite, and code execution impact.

Mitigation direction

  • Upgrade Sourcetree for Windows to version 3.0.0 or later.
  • Review Atlassian SRCTREEWIN-9077 for vendor-specific guidance.
  • Avoid opening untrusted Mercurial repositories in vulnerable Sourcetree versions.
  • Restrict commit access to Mercurial repositories used by Windows developers.
  • Review repositories for Git subrepository usage before opening them in older clients.

Validation and detection

  • Inventory Sourcetree for Windows versions across developer workstations.
  • Confirm no installed version is earlier than 3.0.0.
  • Identify Mercurial repositories linked in Sourcetree.
  • Check whether those Mercurial repositories use Git subrepositories.
  • Review repository commit permissions for unnecessary or stale access.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-13397 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AtlassianSourcetree for Windows0.5.1.0, unspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.