---
title: "CVE-2022-20001\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2022-20001?format=md
keywords: index, follow
---

# CVE-2022-20001

Publication date 14 March 2022

Last updated 26 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**7.8 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2022-20001?format=md#impact-score)

Toggle side navigation

## Description

fish is a command line shell. fish version 3.1.0 through version 3.3.1 is
vulnerable to arbitrary code execution. git repositories can contain
per-repository configuration that change the behavior of git, including
running arbitrary commands. When using the default configuration of fish,
changing to a directory automatically runs `git` commands in order to
display information about the current repository in the prompt. If an
attacker can convince a user to change their current directory into one
controlled by the attacker, such as on a shared file system or extracted
archive, fish will run arbitrary commands under the attacker's control.
This problem has been fixed in fish 3.4.0. Note that running git in these
directories, including using the git tab completion, remains a potential
trigger for this issue. As a workaround, remove the `fish\_git\_prompt`
function from the prompt.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| fish | 26.04 LTS resolute | Not affected |
| 25.10 questing | Not affected |
| 25.04 plucky | Not affected |
| 24.10 oracular | Not affected |
| 24.04 LTS noble | Not affected |
| 23.10 mantic | Not affected |
| 23.04 lunar | Not affected |
| 22.10 kinetic | Ignored end of life, was needed |
| 22.04 LTS jammy | Fixed 3.3.1+ds-3ubuntu0.1~esm1  Ubuntu Pro |
| 21.10 impish | Ignored end of life |
| 20.04 LTS focal | Fixed 3.1.0-1.2ubuntu0.1~esm1  Ubuntu Pro |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Ignored end of standard support, was not-affected |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2022-20001?format=md#patch-details)

### Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

[Get Ubuntu Pro](https://ubuntu.com/pro)
[30-day free trial](https://ubuntu.com/pro/free-trial)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| fish | * Upstream:   [3762505](https://github.com/fish-shell/fish-shell/commit/37625053d424c1ab88de2b0c50c7fe71e1468e2c) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

7.8 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Local |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | Required |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 7.8 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20001)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-20001)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-20001)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2022-20001)

### Related Ubuntu Security Notices (USN)

+ [USN-5367-1](https://usn.ubuntu.com/USN-5367-1)
+ fish vulnerability
+ 10 August 2022

### Other references

* <https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq>
* <https://github.com/fish-shell/fish-shell/pull/8589>
* <https://github.com/fish-shell/fish-shell/commit/37625053d424c1ab88de2b0c50c7fe71e1468e2c (3.4.0)>
* <https://github.com/fish-shell/fish-shell/releases/tag/3.4.0>
* <https://www.cve.org/CVERecord?id=CVE-2022-20001>