Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by amoffat
CVE-2026-54552 (GCVE-0-2026-54552)
Vulnerability from nvd – Published: 2026-08-18 17:37 – Updated: 2026-08-18 18:44
VLAI
EPSS
VEX
Title
sh _uid does not drop supplementary groups (incomplete privilege drop)
Summary
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:44 UTC
CWE
- CWE-273 - Improper Check for Dropped Privileges
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/amoffat/sh/security/advisories… | x_refsource_CONFIRM |
| https://github.com/amoffat/sh/pull/776 | x_refsource_MISC |
| https://github.com/amoffat/sh/commit/3d855daba91f… | x_refsource_MISC |
| https://github.com/amoffat/sh/releases/tag/2.2.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:44:23.350805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:44:38.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sh",
"vendor": "amoffat",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process\u0027s supplementary groups because the privilege-drop sequence does not fully establish the target user\u0027s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-273",
"description": "CWE-273: Improper Check for Dropped Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:37:40.430Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55"
},
{
"name": "https://github.com/amoffat/sh/pull/776",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/amoffat/sh/pull/776"
},
{
"name": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1"
},
{
"name": "https://github.com/amoffat/sh/releases/tag/2.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/amoffat/sh/releases/tag/2.2.4"
}
],
"source": {
"advisory": "GHSA-q38v-wp89-2w55",
"discovery": "UNKNOWN"
},
"title": "sh _uid does not drop supplementary groups (incomplete privilege drop)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54552",
"datePublished": "2026-08-18T17:37:40.430Z",
"dateReserved": "2026-06-15T19:04:14.456Z",
"dateUpdated": "2026-08-18T18:44:38.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54552 (GCVE-0-2026-54552)
Vulnerability from cvelistv5 – Published: 2026-08-18 17:37 – Updated: 2026-08-18 18:44
VLAI
EPSS
VEX
Title
sh _uid does not drop supplementary groups (incomplete privilege drop)
Summary
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:44 UTC
CWE
- CWE-273 - Improper Check for Dropped Privileges
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/amoffat/sh/security/advisories… | x_refsource_CONFIRM |
| https://github.com/amoffat/sh/pull/776 | x_refsource_MISC |
| https://github.com/amoffat/sh/commit/3d855daba91f… | x_refsource_MISC |
| https://github.com/amoffat/sh/releases/tag/2.2.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:44:23.350805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:44:38.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sh",
"vendor": "amoffat",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process\u0027s supplementary groups because the privilege-drop sequence does not fully establish the target user\u0027s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-273",
"description": "CWE-273: Improper Check for Dropped Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:37:40.430Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55"
},
{
"name": "https://github.com/amoffat/sh/pull/776",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/amoffat/sh/pull/776"
},
{
"name": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1"
},
{
"name": "https://github.com/amoffat/sh/releases/tag/2.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/amoffat/sh/releases/tag/2.2.4"
}
],
"source": {
"advisory": "GHSA-q38v-wp89-2w55",
"discovery": "UNKNOWN"
},
"title": "sh _uid does not drop supplementary groups (incomplete privilege drop)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54552",
"datePublished": "2026-08-18T17:37:40.430Z",
"dateReserved": "2026-06-15T19:04:14.456Z",
"dateUpdated": "2026-08-18T18:44:38.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}