Live › vulnerability › CVE-2026-95168
Go to dashboardthefuck 3.32 (and current master) executes every rule module found in thefuck_contrib_*/rules on any writable sys.path entry, plus the user rules dir, at load time, before rule enable checks. Anyone who can write to a sys.path entry used by another user's interpreter gets code run as that user whenever they run thefuck. No upstream fix is released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems with thefuck installed where a lower-privileged local user can write into a sys.path entry (shared virtualenv, group-writable site-packages) or into the user's thefuck rules directory. Shared multi-user machines and shared dev boxes are the real exposure. On single-user machines it reduces to ordinary package-integrity trust, so you can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| thefuck | pypi | <= 3.32 | – |
pip show thefuck (or thefuck --version): 3.32 and earlier with rule loading from sys.path is affected; no fixed version exists.python -c "import sys,glob;[print(p) for d in sys.path for p in glob.glob(d+'/thefuck_contrib_*')]" and review any you did not install.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py
This page as .md · .json · in your agent: get_signal("CVE-2026-95168")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.