https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-49284.htmlhttps://patchthecve.com/cve/CVE-2023-49284.htmlWed, 17 Jun 2026 06:35:45 +0000LOW 3.9: fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transformihttps://patchthecve.com/cve/CVE-2022-20001.htmlhttps://patchthecve.com/cve/CVE-2022-20001.htmlWed, 17 Jun 2026 04:23:29 +0000HIGH 7.8: fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing tohttps://patchthecve.com/cve/CVE-2014-3856.htmlhttps://patchthecve.com/cve/CVE-2014-3856.htmlWed, 17 Jun 2026 00:09:02 +0000HIGH 7.0: The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.https://patchthecve.com/cve/CVE-2014-2914.htmlhttps://patchthecve.com/cve/CVE-2014-2914.htmlWed, 17 Jun 2026 00:07:21 +0000CRITICAL 9.8: fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.https://patchthecve.com/cve/CVE-2014-2906.htmlhttps://patchthecve.com/cve/CVE-2014-2906.htmlWed, 17 Jun 2026 00:07:20 +0000HIGH 7.0: The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.https://patchthecve.com/cve/CVE-2014-3219.htmlhttps://patchthecve.com/cve/CVE-2014-3219.htmlWed, 17 Jun 2026 00:07:49 +0000HIGH 7.8: fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.https://patchthecve.com/cve/CVE-2014-2905.htmlhttps://patchthecve.com/cve/CVE-2014-2905.htmlWed, 17 Jun 2026 00:07:20 +0000MEDIUM 6.9: fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.