Hi,

The following vulnerability was published for thefuck.

CVE-2026-95168[0]:
| An issue in nvbn thefuck v.3.32 allows a local attacker to execute
| arbitrary code via the get_rules_import_paths in
| thefuck/corrector.py and Rule.from_path in thefuck/types.py

https://github.com/nvbn/thefuck/issues/1623


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-95168
https://www.cve.org/CVERecord?id=CVE-2026-95168

Please adjust the affected versions in the BTS as needed.