What is GHSA-fq3w-p4fg-mw73?

GHSA-fq3w-p4fg-mw73 is a security advisory published by GitHub Security Advisories with Low severity. fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

Why does GHSA-fq3w-p4fg-mw73 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-fq3w-p4fg-mw73?

GHSA-fq3w-p4fg-mw73 affects 1 product, including: rust/fixurjavainstall:\u003c= 0.8.0.

GHSA-fq3w-p4fg-mw73LowDisclosed before NVD

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`

Vendor

GitHub Security Advisories

Published

June 25, 2026

Last Modified

June 25, 2026

📋 Description

Impact

Affects: Anyone who generates the UNIX man pages in Fuji <= 0.8.0 build with the dev crate feature. Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries.

Patches

At the time of writing, no new version has been released on crates.io, due to an unrelated CI/CD publishing issue. Due to the same unrelated publishing issue, no new GitHub Releases version has been released.

Workarounds

Do not run fuji manual on non-dev builds for versions <= 0.8.0.

Additional Information

This bug results from development-only code being accidentally left in for release use. Previous versions of Fuji are still "safe" to use, provided that you do not run fuji manual. There is no malicious potential from this, it's just a major annoyance to accidentally remove all your sysadmin man pages.

🎯 Affected products1

rust/fixurjavainstall:<= 0.8.0