CVE-2021-34363: Path Traversal leads to arbitrary file deletion in thefuck package
Summary
CVE-2021-34363: The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature. Affects thefuck across 2 version ranges.
< 3.31
< e343c577cd7da4d304b837d4a07ab4df1e023092
Fixed in e343c577cd7da4d304b837d4a07ab4df1e023092. How to fix ↓
Also tracked for
- thefuck · Debian:11
The same CVE-2021-34363 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The thefuck (aka The Fuck) package is a Python utility that corrects previous console command mistakes. It analyzes the previous command and suggests the appropriate correction. The package is available on PyPI and can be installed using pip. The vulnerability in the package allows for Path Traversal, which can lead to arbitrary file deletion. This vulnerability exists in versions prior to 3.31.
Vulnerability Detail
The vulnerability in the thefuck package arises from a lack of proper input validation. An attacker can exploit this vulnerability by manipulating the input to the "undo archive operation" feature. By traversing the file system using relative paths, an attacker can delete arbitrary files accessible to the user running the thefuck package. This can result in data loss, system instability, or even compromise of the host system.
How To Fix
Latest published version: 3.32.0 as of 22 Oct 2026
pip install --upgrade "thefuck==3.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
e343c577cd7da4d304b837d4a07ab4df1e023092
This is the first release that contains the fix.
pip install --upgrade "thefuck==e343c577cd7da4d304b837d4a07ab4df1e023092"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the "undo archive operation" feature in the thefuck package. This can be done by modifying the configuration file or by setting the appropriate environment variable. However, this workaround may limit the functionality of the package.
Conclusion
The thefuck package prior to version 3.31 is vulnerable to a Path Traversal issue that allows for arbitrary file deletion. Users are advised to update the package to the latest version and regularly update all installed packages to ensure the latest security patches are applied. Disabling the "undo archive operation" feature can serve as a temporary workaround, but it is recommended to apply the permanent fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for thefuck →
FAQ
This vulnerability allows an attacker to delete arbitrary files on the system, potentially leading to data loss or compromise of the host system.
You can use the Vulert playground at Vulert Scanner to check if your version of the thefuck package is affected by this vulnerability. Simply enter your Pipfile.lock and it will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly update the package to mitigate the risk.
A temporary workaround is available by disabling the "undo archive operation" feature in the thefuck package. However, it is strongly recommended to update the package to the latest version as soon as possible.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is crucial to apply the recommended fixes to prevent any potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for thefuck.
