CVE-2026-54552

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1
https://github.com/amoffat/sh/pull/776
https://github.com/amoffat/sh/releases/tag/2.2.4
https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) sh proporciona el lanzamiento de procesos Python. Antes de la 2.2.4, la opción _uid en sh.py realiza una caída de privilegios incompleta en sistemas Linux y similares a Unix. Cuando sh se ejecuta desde un proceso elevado y lanza un comando con _uid establecido a un usuario no privilegiado, el proceso hijo cambia su UID pero puede retener los grupos suplementarios del proceso padre porque la secuencia de caída de privilegios no establece completamente el UID, GID primario y grupos suplementarios del usuario objetivo. Por lo tanto, el proceso hijo puede retener el acceso a archivos o recursos otorgados a grupos privilegiados como root, docker, disk, shadow o sudo, violando el límite de privilegios _uid esperado. Este problema se corrige en la versión 2.2.4.

Information

Published : 2026-08-18 18:18

Updated : 2026-10-22 22:10

NVD link : CVE-2026-54552

Mitre link : CVE-2026-54552

CVE.ORG link : CVE-2026-54552

JSON object : View

Products Affected

No product.

CWE

CWE-273

Improper Check for Dropped Privileges

{"id": "CVE-2026-54552", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54552", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T18:44:23.350805Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "amoffat", "product": "sh", "versions": [{"status": "affected", "version": "< 2.2.4"}]}]}], "published": "2026-08-18T18:18:23.147", "references": [{"url": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1", "source": "security-advisories@github.com"}, {"url": "https://github.com/amoffat/sh/pull/776", "source": "security-advisories@github.com"}, {"url": "https://github.com/amoffat/sh/releases/tag/2.2.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-273"}]}], "descriptions": [{"lang": "en", "value": "sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4."}, {"lang": "es", "value": "sh proporciona el lanzamiento de procesos Python. Antes de la 2.2.4, la opci\u00f3n _uid en sh.py realiza una ca\u00edda de privilegios incompleta en sistemas Linux y similares a Unix. Cuando sh se ejecuta desde un proceso elevado y lanza un comando con _uid establecido a un usuario no privilegiado, el proceso hijo cambia su UID pero puede retener los grupos suplementarios del proceso padre porque la secuencia de ca\u00edda de privilegios no establece completamente el UID, GID primario y grupos suplementarios del usuario objetivo. Por lo tanto, el proceso hijo puede retener el acceso a archivos o recursos otorgados a grupos privilegiados como root, docker, disk, shadow o sudo, violando el l\u00edmite de privilegios _uid esperado. Este problema se corrige en la versi\u00f3n 2.2.4."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}