Fishshell maintains a focused command-shell interpreter widely deployed in development environments and interactive terminal configurations, presenting a narrow but prominent attack surface. The vendor's vulnerabilities skew toward serious outcomes, concentrating in the fish shell product and recurring through weakness classes including race conditions, input validation flaws, link-following issues, and injection vulnerabilities that are characteristic of shell-parsing and script-execution mechanisms. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Fishshell over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-2914CRITICAL fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspec | Jan 28, 2020 | 9.8 | 31 | NO | NO |
CVE-2014-3856HIGH The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a p | Jan 28, 2020 | 7.0 | 21 | NO | NO |
CVE-2014-2906HIGH The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file | Jan 28, 2020 | 7.0 | 21 | NO | NO |
CVE-2022-20001HIGH fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that cha | Mar 14, 2022 | 7.8 | 20 | NO | NO |
CVE-2014-3219HIGH fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.r | Feb 9, 2018 | 7.8 | 20 | NO | NO |
CVE-2014-2905MEDIUM fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fi | May 2, 2014 | 6.9 | 18 | NO | NO |
CVE-2023-49284MEDIUM fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards a | Dec 5, 2023 | 6.6 | 17 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Fishshell.
Media articles that mention a CVE ID that affects a product developed by Fishshell — matched by CVE ID, not by vendor name.