CVE-2022-20001

Name of the Vulnerable Software and Affected Versions fish versions 3.1.0 through 3.3.1

Description The issue is related to arbitrary code execution. Fish, a command line shell, can run arbitrary commands under an attacker's control when using the default configuration and changing to a directory controlled by the attacker. This can happen on shared file systems or extracted archives. Git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. The problem is fixed in fish 3.4.0. Running git in these directories, including using the git tab completion, remains a potential trigger for this issue.

Recommendations For fish versions 3.1.0 through 3.3.1, update to fish 3.4.0 to resolve the issue. As a temporary workaround, consider removing the fish git prompt function from the prompt to minimize the risk of exploitation.