PT-2022-2060 · Fish+3 · Fish+3

Justin Steven · Published 2022-03-12 · Updated 2025-05-15 · CVE-2022-20001

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fish versions 3.1.0 through 3.3.1

Description The issue is related to arbitrary code execution. Fish, a command line shell, can run arbitrary commands under an attacker's control when using the default configuration and changing to a directory controlled by the attacker. This can happen on shared file systems or extracted archives. Git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. The problem is fixed in fish 3.4.0. Running git in these directories, including using the git tab completion, remains a potential trigger for this issue.

Recommendations For fish versions 3.1.0 through 3.3.1, update to fish 3.4.0 to resolve the issue. As a temporary workaround, consider removing the fish git prompt function from the prompt to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Uncontrolled Search Path Element

Weakness Enumeration

CWE-74

CWE-427

Related Identifiers

ALT-PU-2022-1535

ALT-PU-2023-1907

ALT-PU-2023-2076

ALT-PU-2023-7981

BDU:2022-01726

CVE-2022-20001

DSA-5234-1

GHSA-PJ5F-6VXJ-F5MQ

MGASA-2022-0181

OESA-2022-1689

OPENSUSE-SU-2022:0096-1

OPENSUSE-SU-2024:11936-1

USN-5367-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Fish

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/20xxx/CVE-2022-20001.json · Exploit
• https://github.com/fish-shell/fish-shell/pull/8589 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-20001 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/676697 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-20001 · Vendor Advisory
• https://security.gentoo.org/glsa/202309-10 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5367-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/TRNMYS2LKB6TKOOBQQRSRQICDMWLZ4QL · Vendor Advisory
• https://osv.dev/vulnerability/USN-5367-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20001 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRNMYS2LKB6TKOOBQQRSRQICDMWLZ4QL · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0181 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-20001 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-20001 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5234-1 · Vendor Advisory