Critical severity9.8NVD Advisory· Published May 4, 2017· Updated Jun 17, 2026

CVE-2017-8768

Description

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID number is SRCTREE-4632.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Atlassian/Sourcetree
cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:*:*:*
Range: <=2.5c

Patches

Vulnerability mechanics

References

openwall.com/lists/oss-security/2017/05/03/5nvdMailing ListThird Party Advisory
seclists.org/fulldisclosure/2017/May/10nvdMailing ListThird Party Advisory
www.securityfocus.com/bid/98329nvdThird Party AdvisoryVDB Entry
www.youtube.com/watchnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.007
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000