fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config) which allows remote attackers to execute arbitrary code via unspecified vectors as demonstrated by set_prompt.