GitHub Advisoryadvisory · crates.io

GHSA-fq3w-p4fg-mw73 fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

LOW Published 2026-06-25 Modified 2026-06-25 Official page ↗
Ecosystem
crates.io
Packages
fixurjavainstall
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-489
Reviewed
2026-06-25

Affected packages

• crates.io fixurjavainstall: < 0.8.1 → fixed in 0.8.1

Description

Impact Affects: Anyone who generates the UNIX man pages in Fuji <= `0.8.0` build with the `dev` crate feature. Consequences: `/usr/share/man/man8` may be entirely removed & re-created without any of the previous entries. Patches At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released. Workarounds Do not run `fuji manual` on non-`dev` builds for versions <= `0.8.0`. Additional Information This bug results from development-only code being accidentally left in for release use. Previous versions of Fuji are still "safe" to use, provided that you do not run `fuji manual`. There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.

Related

Weakness · CWE (1)

  • CWE-489 Active Debug Code weakness

References