Skip to content
OpenAdvisories
High USN-5367-1 1 CVE

fish vulnerability

Published Aug 10, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Justin Steven discovered that fish was not properly filtering local
git configuration directives when running background git commands.
A remote unauthenticated attacker could possibly use this issue to
execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS fish 3.1.0-1.2ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS fish 3.3.1+ds-3ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.8
    CVE-2022-20001

    Injection in fish

    fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the d…

    fish-shell fish-shell fish fish Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2022-20001