diff --git a/fish.changes b/fish.changes
index fba1f64..44bf051 100644
--- a/fish.changes
+++ b/fish.changes
@@ -23,7 +23,7 @@ Wed Dec  6 12:42:56 UTC 2023 - Dan Čermák <dcermak@suse.com>
 
   While this may cause unexpected behavior with direct input, this may become a minor security problem
   if the output is being fed from an external program into a command substitution where this output
-  may not be expected.
+  may not be expected. (bsc#1217808, CVE-2023-49284) 
 
 -------------------------------------------------------------------
 Tue Dec  5 08:08:21 UTC 2023 - Dan Čermák <dcermak@suse.com>