CVE-2022-20001
Injection in fish
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Injection in fish
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
- Record
CVE-2022-20001- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2022-25261
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
- Record
EUVD-2022-25261- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
- Record
CVE-2022-20001- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-74, CWE-427
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-20001
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
- Record
ALPINE-CVE-2022-20001- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Injection in fish
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
- Record
CVE-2022-20001- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-20001
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
- Record
DEBIAN-CVE-2022-20001- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 6 moreShow less
OSVOESA-2022-1689
fish security update
fish is a fully-equipped command line shell (like bash or zsh) that is smart and user-friendly. fish supports powerful features like syntax highlighting, autosuggestions, and tab completions that just work, with nothing to learn or configure.
Security Fix(es):
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.(CVE-2022-20001)
- Record
OESA-2022-1689- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-20001
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fish_git_prompt function from the prompt.
- Record
UBUNTU-CVE-2022-20001- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2022-0181 No score
Updated fish packages fix security vulnerability
Arbitrary Code Execution. (CVE-2022-20001)
- Record
MGASA-2022-0181- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0096-1 No score
Security update for fish3
This update for fish3 fixes the following issues:
- CVE-2022-20001: Navigating to a compromised git repository may lead to arbitrary code execution (bsc#1197139)
- Record
openSUSE-SU-2022:0096-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11936-1 No score
fish-3.4.0-1.1 on GA media
These are all security issues fixed in the fish-3.4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11936-1- Updated
- 2026-11-02
OSVUSN-5367-1 No score
fish vulnerability
Justin Steven discovered that fish was not properly filtering local git configuration directives when running background git commands. A remote unauthenticated attacker could possibly use this issue to execute arbitrary code.
- Record
USN-5367-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fishAlpine:v3.16 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.17 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.18 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.19 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.20 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.21 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.22 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.23 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishAlpine:v3.24 |
3.1.0 up to 3.4.0-r0 | 3.4.0-r0 |
fishDebian:12 |
before 3.4.0+ds-1 | 3.4.0+ds-1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
fishDebian:13 |
before 3.4.0+ds-1 | 3.4.0+ds-1 |
fishDebian:14 |
before 3.4.0+ds-1 | 3.4.0+ds-1 |
fishDebian:11 |
before 3.1.2-3+deb11u1, plus listed versions 3.1.2-3 |
3.1.2-3+deb11u1 |
fishMageia:8 |
before 3.4.1-1.mga8 | 3.4.1-1.mga8 |
fishopenEuler:20.03-LTS-SP1 |
before 3.3.1-2.oe1 | 3.3.1-2.oe1 |
fishopenEuler:20.03-LTS-SP3 |
before 3.3.1-2.oe1 | 3.3.1-2.oe1 |
fishopenEuler:22.03-LTS |
before 3.3.1-4.oe2203 | 3.3.1-4.oe2203 |
fishUbuntu:Pro:20.04:LTS |
before 3.1.0-1.2ubuntu0.1~esm1, plus listed versions 3.0.2-23.1.0-13.1.0-1.13.1.0-1.2 |
3.1.0-1.2ubuntu0.1~esm1 |
fishUbuntu:Pro:22.04:LTS |
before 3.3.1+ds-3ubuntu0.1~esm1, plus listed versions 3.1.2-3ubuntu13.3.1+ds-23.3.1+ds-3 |
3.3.1+ds-3ubuntu0.1~esm1 |
fish3SUSE:Package Hub 15 SP3 |
before 3.3.1-bp153.2.10.1 | 3.3.1-bp153.2.10.1 |
fish3openSUSE:Leap 15.3 |
before 3.3.1-bp153.2.10.1 | 3.3.1-bp153.2.10.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-20001 is a high vulnerability (CVSS 7.8) in Fishshell Fish, published March 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in fish 3.4.0-r0.
References
github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRNMYS2LKB6TKOOBQQRSRQICDMWLZ4QL
debian.org/security/2022/dsa-5234
Show 16 moreShow less
security.gentoo.org/glsa/202309-10
security.alpinelinux.org/vuln/CVE-2022-20001
nvd.nist.gov/vuln/detail/CVE-2022-20001
security-tracker.debian.org/tracker/CVE-2022-20001
advisories.mageia.org/MGASA-2022-0181.html
bugs.mageia.org/show_bug.cgi?id=30227
lists.opensuse.org/archives/list/[email protected]/thread/SRNZU5M6WR5TPTNDAIMOYXCJP2ONI4FB
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1689
ubuntu.com/security/CVE-2022-20001
cve.org/CVERecord?id=CVE-2022-20001
bugzilla.suse.com/1197139
suse.com/security/cve/CVE-2022-20001