CVE-2023-49284 (https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f): fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. The above has been fixed in 3.6.2
Hi, I've checked simple bump from 3.6.1 to 3.6.4 and it works fine for me.
