Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M
CVE-2026-21882theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution
High 8.4
In plain English
A high-severity privilege mismanagement in theshit from AsfhtgkDavid. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 89.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AsfhtgkDavid | theshit | < 0.2.0 |
Weakness: CWE-273, CWE-269, CWE-250 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H