CVE-2026-54552

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1
https://github.com/amoffat/sh/pull/776
https://github.com/amoffat/sh/releases/tag/2.2.4
https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-18 18:18

Updated : 2026-08-18 19:16

NVD link : CVE-2026-54552

Mitre link : CVE-2026-54552

CVE.ORG link : CVE-2026-54552

JSON object : View

Products Affected

No product.

CWE

CWE-273

Improper Check for Dropped Privileges

{"id": "CVE-2026-54552", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54552", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T18:44:23.350805Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "amoffat", "product": "sh", "versions": [{"status": "affected", "version": "< 2.2.4"}]}]}], "published": "2026-08-18T18:18:23.147", "references": [{"url": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1", "source": "security-advisories@github.com"}, {"url": "https://github.com/amoffat/sh/pull/776", "source": "security-advisories@github.com"}, {"url": "https://github.com/amoffat/sh/releases/tag/2.2.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-273"}]}], "descriptions": [{"lang": "en", "value": "sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4."}], "lastModified": "2026-08-18T19:16:57.803", "sourceIdentifier": "security-advisories@github.com"}