CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCVE-2021-34363
Critical (9.1). EPSS 1.8% chance of exploitation in the next 30 days. Fixed in thefuck 3.31.
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
Severity
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- the_fuck_project:the_fuck
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8wwf-2644-f8x4 | PyPI | thefuck | <3.31 | 3.31 |
| PYSEC-2021-97 | PyPI | thefuck | <3.31 | 3.31 |
References
- https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092
- https://github.com/nvbn/thefuck/releases/tag/3.31
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4MEDDLBFVRUQHPYIBJ4MFM3M4NUJUXL5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YA6UNQSOY6M3NJDZLS6YJXTS4WGDMEEJ/
- https://vuln.ryotak.me/advisories/48