{"id":"CVE-2026-54552","aliases":["GHSA-q38v-wp89-2w55","PYSEC-2026-3540"],"url":"https://o3.security/vulnerability/CVE-2026-54552","summary":"sh _uid does not drop supplementary groups (incomplete privilege drop)","details":"### Impact\nThe `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems.\n\nWhen `sh` was run from a process with elevated privileges, such as root, and a command was launched with `_uid=<unprivileged user>`, the child process changed its UID and primary GID but did not reset its supplementary groups. As a result, the child process could retain the parent process’s supplementary groups, potentially including privileged groups such as root, docker, disk, shadow, or sudo.\n\nThis could allow a subprocess that was expected to run with reduced privileges to access files or resources available to the original process’s supplementary groups. Users are impacted if they rely on `_uid` as a privilege boundary when launching commands from a privileged parent process.\n\n### Patches\nUpgrade to version >= 2.2.4\n\n### Workarounds\nAvoid using `_uid` when the user represents a less-privileged user.","published":"2026-08-18T17:37:40.430Z","modified":"2026-10-24T02:30:27.727819544Z","cvss":{"score":7.9,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"},"epss":{"score":0.00125,"percentile":0.0253,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"sh","fixedVersion":"2.2.4"}],"fix":{"url":"https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1","label":"amoffat/sh@3d855da"},"references":[{"type":"WEB","url":"https://github.com/amoffat/sh/releases/tag/2.2.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54552.json"},{"type":"ADVISORY","url":"https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54552"},{"type":"FIX","url":"https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1"},{"type":"FIX","url":"https://github.com/amoffat/sh/pull/776"},{"type":"PACKAGE","url":"https://github.com/amoffat/sh"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:30:27.727819544Z"}}