https://vulnerability.circl.lu/sightings/feed 2026-09-19T17:35:53.108188+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/9d4860e2-08a1-4568-89c3-88dd39d5bbd9/export 2026-09-19T17:35:53.114931+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9d4860e2-08a1-4568-89c3-88dd39d5bbd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3w57-8xmc-8v26", "type": "seen", "source": "https://gist.github.com/alon710/fb43b5674daf6e26005b27c98e4ca3cf", "content": "# CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63349\n\n## Summary\nCVE-2026-63349 is a critical privilege-dropping bypass vulnerability in the AnyIO asynchronous framework (versions 4.14.0 and 4.14.1) on POSIX platforms. Due to a variable assignment typo, supplementary groups specified by the developer are not correctly propagated to the execution backend, resulting in subprocesses retaining the parent process's elevated supplementary group permissions.\n\n## TL;DR\nA typo in AnyIO 4.14.0 and 4.14.1 causes subprocesses to retain the parent's supplementary groups (such as 'docker' or 'shadow'), bypassing security boundaries designed to drop privileges.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-266 / CWE-269\n- **Attack Vector**: Local\n- **CVSS v4.0 Score**: 7.0 (High)\n- **Exploit Status**: Proof-of-Concept / Theoretical\n- **KEV Status**: Not Listed\n- **Affected Component**: anyio._core._subprocesses\n\n## Affected Systems\n\n- AnyIO (Python asynchronous library) versions 4.14.0 and 4.14.1 running on POSIX systems\n- **AnyIO**: >= 4.14.0, < 4.14.2 (Fixed in: `4.14.2`)\n\n## Mitigation\n\n- Upgrade to AnyIO version 4.14.2 or higher.\n- Directly utilize Python's native asyncio or subprocess modules to execute processes with privilege dropping in environment-constrained setups.\n\n**Remediation Steps:**\n1. Identify all installed instances of AnyIO within the Python environment using 'pip show anyio'.\n2. Update requirements.txt, pyproject.toml, or Pipfile configurations to enforce dependencies of anyio >= 4.14.2.\n3. Run automated vulnerability scanning tools to verify the closure of vulnerability CVE-2026-63349.\n\n## References\n\n- [NVD - CVE-2026-63349](https://nvd.nist.gov/vuln/detail/CVE-2026-63349)\n- [GitHub Security Advisory GHSA-3w57-8xmc-8v26](https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63349) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T13:31:35.820165Z"} 2026-09-19T13:31:35.820165+00:00