CVE-2026-95168: n/a

CVE-2026-95168 describes a local code execution vulnerability in nvbn thefuck versions prior to 3.33. The flaw exists in the get_rules_import_paths function within thefuck/corrector.py and the Rule.from_path function within thefuck/types.py, which can be exploited by a local attacker to execute arbitrary code. No further technical details or exploitation methods are provided in the available data.

A local attacker can execute arbitrary code on affected systems running nvbn thefuck versions before 3.33. This could lead to full control of the affected environment by the attacker with local access. There is no indication of remote exploitation or active exploits in the wild.

Upgrade nvbn thefuck to version 3.33 or later, where this vulnerability is fixed. No vendor advisory is provided, but the affectedVersions field indicates the fix is in 3.33. Until upgrading, restrict local access to trusted users only.