Vulnerability · Published Jul 24, 2025 · Assigned by atlassian
CVE-2025-22165
Medium 5.9
In plain English
A medium-severity privilege mismanagement in Sourcetree for Mac from Atlassian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives . You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives . This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Sourcetree for Mac | All versions from 4.2.8 to 4.2.11 inclusive |
Weakness: CWE-269 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:H/SI:H/SA:L