CVE-2026-54552
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.9
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- EPSS probability
- 0.13%
- CWE
- CWE-273
- Published
- 2026-08-18
- Last modified
- 2026-08-18
Affected products
- amoffat sh
Weakness type
Related vulnerabilities
- CVE-2026-58089 — hwpmc fails to detach PMCs during exec credential transitions
- CVE-2026-61897 — accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts
- CVE-2026-58086 — ktrace(2) privilege incorrectly validated in jails
- CVE-2026-49421 — unlinkat(2) ignores AT_RESOLVE_BENEATH flag
- CVE-2026-60085 — PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox
- CVE-2026-44073 — seteuid failure ignored in auth modules
- CVE-2026-32107 — xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails
- CVE-2026-21882 — theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution