Cyber Resilience

CVE-2024-42482

Fish-Shop Syntax-Check ≤ 1.6.12

Published
12 August 2024
Modified
17 September 2024
Patch / advisory
CVSS Score v3.1 4.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0082 54th percentile
Risk Priority 41 floored blend · peak EPSS

Summary

CVE-2024-42482 is a medium-severity Improper Neutralization of Delimiters (CWE-140) vulnerability in Fish-Shop Syntax-Check. Its CVSS base score is 4.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification…

more

of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1659 Content Injection Initial Access
Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-6542Shared CWE-140
CVE-2026-33457Shared CWE-140
CVE-2024-38865Shared CWE-140
CVE-2025-32918Shared CWE-140
CVE-2024-38866Shared CWE-140
CVE-2023-6157Shared CWE-140
CVE-2026-33456Shared CWE-140
CVE-2025-52989Shared CWE-140
CVE-2026-33455Shared CWE-140
CVE-2023-6156Shared CWE-140

Affected Assets

fish-shop
syntax-check
≤ 1.6.12

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover missing or incorrect delimiter neutralization through targeted test cases.

Input validation directly enforces neutralization of delimiters before they reach parsers or interpreters.

Secure engineering principles include explicit requirements for proper delimiter handling and sanitization.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper delimiter neutralization during input handling and output encoding.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development and acceptance can detect delimiter-related weaknesses before deployment.

prevents

Secure development life cycle incorporates practices that reduce the likelihood of delimiter-neutralization defects.

prevents

Application security requirements include input validation and output encoding that mitigate delimiter mishandling.

prevents

Secure coding explicitly requires proper neutralization of delimiters to prevent injection and parsing flaws.

References