{"uuid": "fc4cede8-d632-4dd4-865f-4e967a08b586", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63349", "type": "seen", "source": "https://gist.github.com/alon710/fb43b5674daf6e26005b27c98e4ca3cf", "content": "# CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63349\n\n## Summary\nCVE-2026-63349 is a critical privilege-dropping bypass vulnerability in the AnyIO asynchronous framework (versions 4.14.0 and 4.14.1) on POSIX platforms. Due to a variable assignment typo, supplementary groups specified by the developer are not correctly propagated to the execution backend, resulting in subprocesses retaining the parent process's elevated supplementary group permissions.\n\n## TL;DR\nA typo in AnyIO 4.14.0 and 4.14.1 causes subprocesses to retain the parent's supplementary groups (such as 'docker' or 'shadow'), bypassing security boundaries designed to drop privileges.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-266 / CWE-269\n- **Attack Vector**: Local\n- **CVSS v4.0 Score**: 7.0 (High)\n- **Exploit Status**: Proof-of-Concept / Theoretical\n- **KEV Status**: Not Listed\n- **Affected Component**: anyio._core._subprocesses\n\n## Affected Systems\n\n- AnyIO (Python asynchronous library) versions 4.14.0 and 4.14.1 running on POSIX systems\n- **AnyIO**: >= 4.14.0, < 4.14.2 (Fixed in: `4.14.2`)\n\n## Mitigation\n\n- Upgrade to AnyIO version 4.14.2 or higher.\n- Directly utilize Python's native asyncio or subprocess modules to execute processes with privilege dropping in environment-constrained setups.\n\n**Remediation Steps:**\n1. Identify all installed instances of AnyIO within the Python environment using 'pip show anyio'.\n2. Update requirements.txt, pyproject.toml, or Pipfile configurations to enforce dependencies of anyio >= 4.14.2.\n3. Run automated vulnerability scanning tools to verify the closure of vulnerability CVE-2026-63349.\n\n## References\n\n- [NVD - CVE-2026-63349](https://nvd.nist.gov/vuln/detail/CVE-2026-63349)\n- [GitHub Security Advisory GHSA-3w57-8xmc-8v26](https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63349) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T13:31:35.766708Z"}