CVE-2024-42482
Fish-Shop Syntax-Check ≤ 1.6.12
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2024-42482 is a medium-severity Improper Neutralization of Delimiters (CWE-140) vulnerability in Fish-Shop Syntax-Check. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2685
Vulnerability Data
fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification…
more
of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect delimiter neutralization through targeted test cases.
Input validation directly enforces neutralization of delimiters before they reach parsers or interpreters.
Secure engineering principles include explicit requirements for proper delimiter handling and sanitization.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper delimiter neutralization during input handling and output encoding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect delimiter-related weaknesses before deployment.
Secure development life cycle incorporates practices that reduce the likelihood of delimiter-neutralization defects.
Application security requirements include input validation and output encoding that mitigate delimiter mishandling.
Secure coding explicitly requires proper neutralization of delimiters to prevent injection and parsing flaws.