Description
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Code Execution
Action: Apply Patch
AI Analysis

Impact

An attacker with local access can trigger arbitrary code execution by influencing the get_rules_import_paths function in thefuck/corrector.py and the Rule.from_path constructor in thefuck/types.py. The code paths allow the application to import modules based on unvalidated file system paths, providing a direct vector for executing injected code. The weakness is an improper validation of dynamically loaded code, mapped to CWE‑94 and CWE‑427.

Affected Systems

The vulnerability is specific to the Python package "thefuck" released by nvbn. Version 3.32 is affected. No other vendor or product variants are listed.

Risk and Exploitability

The EPSS score is low, at < 1%, and the CVSS score is 7.8. The vulnerability is not enumerated in the CISA KEV catalog. The attack vector requires local access to the environment where thefuck runs; privilege escalation is possible if the user has elevated rights. Because the vulnerability involves dynamic code import, exploitation is straightforward once the paths are controllable, but the overall risk hinges on the system privileges of the user executing thefuck.

Generated by OpenCVE AI on October 22, 2026 at 20:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update thefuck to the latest stable release that addresses the import path validation flaw.
  • Configure thefuck to load rules only from trusted, whitelisted directories, or disable the dynamic rule import feature if it is not required.
  • Run thefuck under the least privilege or within a sandboxed environment so that any code execution remains confined to a limited context.

Generated by OpenCVE AI on October 22, 2026 at 20:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Nvbn
Nvbn thefuck
Vendors & Products Nvbn
Nvbn thefuck

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Local Arbitrary Code Execution via Rule Import in thefuck thefuck: thefuck: Arbitrary code execution via insecure rule loading
Weaknesses CWE-427
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 20 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Title Local Arbitrary Code Execution via Rule Import in thefuck
Weaknesses CWE-94

Tue, 20 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py
References

Subscriptions

Nvbn Thefuck
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-21T19:17:42.649Z

Reserved: 2026-09-22T00:00:00.000Z

Link: CVE-2026-95168

cve-icon Vulnrichment

Updated: 2026-10-21T19:15:53.357Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T15:17:37.040

Modified: 2026-10-21T20:17:28.007

Link: CVE-2026-95168

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-20T00:00:00Z

Links: CVE-2026-95168 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:00:08Z

Weaknesses
  • CWE-427

    Uncontrolled Search Path Element

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')