https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:44:33 +0000 https://vulnerability.circl.lu/vuln/cve-2026-54552 <p><strong>Affected:</strong> amoffat sh</p> <p>sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process&#39;s supplementary groups because the privilege-drop sequence does not fully establish the target user&#39;s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.</p> <p><strong>Affected:</strong> amoffat sh</p> <p>sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process&#39;s supplementary groups because the privilege-drop sequence does not fully establish the target user&#39;s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.</p> https://vulnerability.circl.lu/vuln/cve-2026-54552