Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-42482

19
FAUCET Score

CVE-2024-42482 describes a command injection vulnerability in the fish-shop/syntax-check GitHub Action, affecting versions prior to v1.6.12 and v2.0.0. This flaw allows arbitrary command execution due to improper neutralization of delimiters in the 'pattern' input, potentially leading to sensitive data exposure or exfiltration from the workflow runner. With a CVSS score of 6.5 (Medium), the vulnerability is network-exploitable with low attack complexity and no user interaction required, though its impact is limited to confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.6.12CPE matchmatch criteria
cpe:2.3:a:fish-shop:syntax-check:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

4.8MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
2.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.82%
Probability of exploitation in next 30 days
EPSS Percentile
53.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0082 is in the 33rd percentile among its peer group of 23,701 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

actionspatch availablevia ghsa
Product: fish-shop/syntax-checkFixed in: 1.6.12
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

actionsGHSA-xj87-mqvh-88w2medium

fish-shop/syntax-check Improper Neutralization of Delimiters

Aug 12, 2024

References

github.com / fish-shop/syntax-check/commit/91e6817c48ad475542fe4e78139029b036a53b03
Patch
github.com / fish-shop/syntax-check/commit/c2cb11395e21119ff8d6e7ea050430ee7d6f49ca
Patch
github.com / fish-shop/syntax-check/security/advisories/GHSA-xj87-mqvh-88w2
Vendor Advisory