GHSA-fq3w-p4fg-mw73 fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

Q: Which versions are affected by GHSA-fq3w-p4fg-mw73?

2 open source packages ship an affected version, including fixurjavainstall.

Q: Is GHSA-fq3w-p4fg-mw73 being exploited?

There is no known exploitation of GHSA-fq3w-p4fg-mw73 in the wild and no public exploit code.

Q: How do I fix GHSA-fq3w-p4fg-mw73?

Upgrade fixurjavainstall to 0.8.1 or later.

Not scored Published 25 Jun 2026

Running the manual generation command in development builds of Fuji can accidentally delete system man pages, requiring users to avoid this command until a fix is released.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-fq3w-p4fg-mw73?

GHSA-fq3w-p4fg-mw73 is a denial of service vulnerability in fixurjavainstall, published on 25 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Impact

Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature. Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries.

Patches

At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.

Workarounds

Do not run fuji manual on non-dev builds for versions <= 0.8.0.

Additional Information

This bug results from development-only code being accidentally left in for release use. Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual. There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.

Which versions are affected by GHSA-fq3w-p4fg-mw73?