Command substitution output can trigger shell expansion in fish shell

published 2023-12-04 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53277

cvss: 3.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

fixed in 1 distros 3 links 1

fishshell fish 3.6.2

debian opensuse azure linux

fish Debian 12 3.6.0-3.1+deb12u1
fish Debian 14, Debian 13 3.6.4-1

debian advisories DEBIAN-CVE-2023-49284

fish openSUSE Tumbleweed 3.6.4-1.1
fish Package Hub 15 SP5, openSUSE Leap 15.5 3.3.1-bp155.4.3.1
fish Package Hub 15 SP4, openSUSE Leap 15.4 3.3.1-bp154.3.3.1

opensuse advisories openSUSE-SU-2024:13501-1 openSUSE-SU-2023:0405-1 openSUSE-SU-2023:0404-1

fish CBL-Mariner 2.0 3.6.2-1

azure linux advisories AZL-32081

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/fish-shell/fish-shell@09986f5 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-49284 updated 2025-11-21 cvss 3.9

fish: command substitution output can trigger shell expansion

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
NVD	3.1	6.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Affected products

fish-shell fish-shell

Classification

Weakness

CWE-436 Interpretation Conflict

References

Sources

CVE List CVE-2023-49284
NVD CVE-2023-49284

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary