Log in Start free

Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-54552sh _uid does not drop supplementary groups (incomplete privilege drop)

High 7.9

In plain English

A high-severity security flaw in sh from amoffat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.9High
Exploit odds (30 days)0.2%top 93.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-shno fix listedDEBIAN-CVE-2026-54552
Debian:13python-shno fix listedDEBIAN-CVE-2026-54552
Debian:14python-sh2.4.0-1DEBIAN-CVE-2026-54552
PyPIsh2.2.4GHSA-q38v-wp89-2w55
PyPIsh2.2.4PYSEC-2026-3540
Ubuntu:22.04:LTSpython-shno fix listedUBUNTU-CVE-2026-54552
Ubuntu:24.04:LTSpython-shno fix listedUBUNTU-CVE-2026-54552
Ubuntu:26.04:LTSpython-shno fix listedUBUNTU-CVE-2026-54552
Ubuntu:26.10python-shno fix listedUBUNTU-CVE-2026-54552

Affected products (as reported)

VendorProductVersions
amoffat sh < 2.2.4

Weakness: CWE-273 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References