CVE-2014-2905: fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users...

Security readout for executives and security teams

CVE-2014-2905 is a local privilege issue in older fish shell releases. A local user could abuse the fish universal variable socket because fish did not properly check credentials. This is mainly a concern on shared systems, developer workstations, or servers where untrusted local users can run code. Exposure is most likely where fish-shell older than 2.1.1 is installed and local shell access is available to multiple users or workloads. Internet-facing exposure is not indicated by the provided sources. Treat as a targeted cleanup item, not an emergency internet-facing incident. Prioritize shared Linux hosts and developer environments where local users or compromised low-privilege accounts could attempt privilege escalation. Mitigation focus: Upgrade fish-shell to version 2.1.1 or later where applicable.; Apply vendor-provided fish-shell security updates for managed Linux distributions.; Restrict local shell access to trusted users until upgraded..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.