CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters
Attackers can inject arbitrary commands via the pattern input in the fish-shop syntax-check GitHub Action, potentially exposing sensitive workflow data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42482?
CVE-2024-42482 is a medium-severity command injection vulnerability in fish-shop syntax-check, published on 12 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action.
Weakness: CWE-140
Which versions are affected by CVE-2024-42482?
1 open source package ship an affected version, including fish-shop/syntax-check. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fish-shop/syntax-check GitHub Actions | All versions | 1.6.12 |
Products include Fish-Shop Syntax-Check.
How do I fix CVE-2024-42482?
Upgrade fish-shop/syntax-check to 1.6.12 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-42482 being exploited?
There is no known exploitation of CVE-2024-42482 in the wild and no public exploit code.
Sources
Also known as GHSA-xj87-mqvh-88w2.