ArchLinux: 202106-39: thefuck: arbitrary file overwrite
Summary
The thefuck package before 3.31 allows path traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
Resolution
Upgrade to 3.31-1.
# pacman -Syu "thefuck>=3.31-1"
The problem has been fixed upstream in version 3.31.
References
https://vuln.ryotak.me/advisories/48 https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092 https://security.archlinux.org/CVE-2021-34363
Workaround
None.