—

PYSEC-2021-97

Quick fix

PYSEC-2021-97 — thefuck: upgrade to the fixed version with the command below.

pip install --upgrade 'thefuck>=e343c577cd7da4d304b837d4a07ab4df1e023092'

Details

The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/thefuck

Introduced in: 0Fixed in: e343c577cd7da4d304b837d4a07ab4df1e023092

Fixpip install --upgrade 'thefuck>=e343c577cd7da4d304b837d4a07ab4df1e023092'

References

https://vuln.ryotak.me/advisories/48[ADVISORY]
https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092[FIX]
https://github.com/nvbn/thefuck/releases/tag/3.31[WEB]
https://github.com/advisories/GHSA-8wwf-2644-f8x4[ADVISORY]