Vulnerability in Fish-shop Syntax-check
CVE-2024-42482
fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that…
EPSS: 0.008 (75.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Fish-shop Syntax-check — versions < 1.6.12
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/fish-shop/syntax-check/security/advisories/GHSA-xj87-mqvh-88w2 (x_refsource_CONFIRM)
- https://github.com/fish-shop/syntax-check/commit/91e6817c48ad475542fe4e78139029b036a53b03 (x_refsource_MISC)
- https://github.com/fish-shop/syntax-check/commit/c2cb11395e21119ff8d6e7ea050430ee7d6f49ca (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-42482?
- CVE-2024-42482 is a medium-severity vulnerability in Fish-shop Syntax-check, classified under CWE-140. CVSS score: 4.8/10. Published 2024-08-12.
- How severe is CVE-2024-42482?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2024-42482 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.