GHSA-fq3w-p4fg-mw73

Source

https://github.com/advisories/GHSA-fq3w-p4fg-mw73

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fq3w-p4fg-mw73/GHSA-fq3w-p4fg-mw73.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fq3w-p4fg-mw73

Published

2026-06-25T18:00:18Z

Modified

2026-06-25T18:15:09Z

Severity

1.2 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

Details

Impact

Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature. Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries.

Patches

At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.

Workarounds

Do not run fuji manual on non-dev builds for versions <= 0.8.0.

Additional Information

This bug results from development-only code being accidentally left in for release use. Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual. There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.

Database specific

{
    "cwe_ids":  [
        "CWE-489"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-25T18:00:18Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

crates.io / fixurjavainstall

Package

Name: fixurjavainstall; View open source insights on deps.dev
Purl: pkg:cargo/fixurjavainstall

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.8.1

Database specific

last_known_affected_version_range

"<= 0.8.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fq3w-p4fg-mw73/GHSA-fq3w-p4fg-mw73.json"