Local command execution via predictable temporary files

Race condition in the psub function in fish 1.16.0 through 2.1.0 allows local users to execute arbitrary commands via predictable temporary files. The function creates a temporary file with a reasonably predictable name, permitting another local process to win a race and replace its contents before a consuming program reads it. Exploitation requires a victim to invoke psub and can supply attacker-controlled input to that victim's downstream command, with privilege escalation depending on how that command handles the substituted file.