CVE-2026-95168 in thefuck
Summary
by MITRE • 10/20/2026
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in thefvck version 3.32 represents a critical security flaw within its command correction mechanism, specifically targeting how the application handles rule imports from local file systems. The Fuck is a popular utility for Unix-based operating systems that corrects mistyped commands by leveraging external rules stored as Python modules. When a user invokes the tool to suggest corrections, it scans designated directories for these rule files and dynamically loads them into memory using standard Python import mechanisms. This design choice introduces significant risk because it assumes all accessible Python files in the search path are trusted code sources, ignoring potential malicious injection by local users or compromised processes on the same system.
The technical root cause lies in the interaction between the get_rules_import_paths function and the Rule.from_path method found within the corrector.py and types.py modules respectively. These functions construct file paths based on user-defined directories or default locations without sufficiently validating the content of those files before execution. If an attacker can write a Python script to one of these scanned directories, they can exploit this trust relationship. By crafting a malicious rule file that contains arbitrary code within its module-level scope or during initialization, the attacker ensures that when The Fuck scans for rules, it inadvertently executes the payload as part of the import process. This constitutes an Arbitrary Code Execution vulnerability where the context is determined by the privileges of the user running The Fuck.
From a classification perspective, this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving dynamic code evaluation or execution via imported modules. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as the vulnerability allows an attacker to leverage legitimate system utilities for malicious purposes without direct exploitation of a binary buffer overflow or memory corruption bug. The attack vector is Local (L), meaning physical access or shell access with limited privileges is required to place the malicious file in the target directory. However, once executed, the impact can be severe depending on the user's permissions, potentially leading to full system compromise if run as root or a privileged service account.
The operational impact of this vulnerability extends beyond simple code execution. An attacker could use this mechanism for privilege escalation by crafting rules that escalate their own privileges, such as modifying sudoers files or creating new administrative accounts. Additionally, the flaw can be leveraged for data exfiltration if the malicious rule is designed to send sensitive information from the user's environment back to a remote server via network requests initiated during the import phase. Since The Fuck often runs in interactive shells where users may have access to sensitive configuration files and credentials stored in plain text or environment variables, the potential damage includes credential theft and lateral movement within local systems.
Mitigation strategies must address both immediate remediation and long-term architectural changes. Users should immediately upgrade to a patched version of The Fuck if one is available from the official repository that implements strict validation for imported modules. In the interim, administrators can mitigate risk by restricting write permissions on directories scanned by get_rules_import_paths so that only trusted system accounts or specific users can add new rule files. Furthermore, implementing file integrity monitoring tools to alert on changes in these directories can provide early detection of malicious insertions. From a development standpoint, future versions should avoid dynamic imports from untrusted paths and instead require explicit whitelisting of allowed modules or use sandboxed execution environments for loading external rules. Security audits focusing on input validation and trust boundaries are essential to prevent similar issues in other tools that rely on dynamic module loading based on user-controlled file system locations.