fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fishconfig), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by setprompt.

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.

fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the fishgitprompt function from the prompt.

The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.

The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.

A number of vulnerabilities were reported in fish versions prior to 2.1.1 [1]:

CVE-2014-2905: fish universal variable socket vulnerable to permission bypass leading to privilege escalation

fish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not check the credentials of processes communicating over the fishd universal variable server UNIX domain socket. This allows a local attacker to elevate their privileges to those of a target user running fish, including root.

fish version 2.1.1 is not vulnerable.

No workaround is currently available for earlier versions of fish.

https://github.com/fish-shell/fish-shell/issues/1436

CVE-2014-2906: fish temporary file creation vulnerable to race condition leading to privilege escalation

fish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates temporary files in an insecure manner.

Versions 1.23.0 to 2.1.0 (inclusive) execute code from these temporary files, allowing privilege escalation to those of any user running fish, including root.

Additionally, from at least version 1.16.0 to version 2.1.0 (inclusive), fish will read data using the psub function from these temporary files, meaning that the input of commands used with the psub function is under the control of the attacker.

fish version 2.1.1 is not vulnerable.

No workaround is currently available for earlier versions of fish.

https://github.com/fish-shell/fish-shell/issues/1437

CVE-2014-2914: fish web interface does not restrict access leading to remote code execution

fish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict connections to the Web-based configuration service (fishconfig). This allows remote attackers to execute arbitrary code in the context of the user running fishconfig.

The service is generally only running for short periods of time.

fish version 2.1.1 restricts incoming connections to localhost only. At this stage, users should avoid running fishconfig on systems where there are untrusted local users, as they are still able to connect to the fishconfig service and elevate their privileges to those of the user running fishconfig.

No workaround is currently available for earlier versions of fish, although the use of the fishconfig tool is optional as other interfaces to fish configuration are available.

https://github.com/fish-shell/fish-shell/issues/1438

The patches going into 2.1.1 can be retrieved from the Integration2.1.1 branch on Github if you would like to patch your own source or packages without updating to 2.1.1: https://github.com/fish-shell/fish-shell/tree/Integration2.1.1 10642a34f17ae45bd93be3ae6021ee920d3da0c2 8412c867a501e3a68e55fef6215e86d3ac9f617b c0989dce2d882c94eb3183e7b94402ba53534abb

Although at this stage we won't be issuing a 2.0.1 release, the patches have been backported to the 2.0.0 branch for distributions that would prefer not to upgrade to the 2.1 series: https://github.com/fish-shell/fish-shell/tree/Integration2.0.1 216d32055d99fbae563ad048436830187a8bfceb aea9ad4965d24ef9c4e346f906194820bac70cc9 55986120aa2cc8ab0809db8ca1f8116491c1fb14

[1] http://www.openwall.com/lists/oss-security/2014/04/28/4

fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.