https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:00:33 +0000 https://cve.radiocsirt.org/vuln/brew-codelimit-cve-2026-54552 <p><strong>Affected:</strong> Homebrew: codelimit</p> <p>### Impact The `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems.</p> <p>When `sh` was run from a process with elevated privileges, such as root, and a command was launched with `_uid=&lt;unprivileged user&gt;`, the child process changed its UID and primary GID but did not reset its supplementary groups. As a result, the child process could retain the parent process’s supplementary groups, potentially including privileged groups such as root, docker, disk, shadow, or sudo.</p> <p>This could allow a subprocess that was expected to run with reduced privileges to access files or resources available to the original process’s supplementary groups. Users are impacted if they rely on `_uid` as a privilege boundary when launching commands from a privileged parent process.</p> <p>### Patches Upgrade to version &gt;= 2.2.4</p> <p>### Workarounds Avoid using `_uid` when the user represents a less-privileged user.</p> <p><strong>Affected:</strong> Homebrew: codelimit</p> <p>### Impact The `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems.</p> <p>When `sh` was run from a process with elevated privileges, such as root, and a command was launched with `_uid=&lt;unprivileged user&gt;`, the child process changed its UID and primary GID but did not reset its supplementary groups. As a result, the child process could retain the parent process’s supplementary groups, potentially including privileged groups such as root, docker, disk, shadow, or sudo.</p> <p>This could allow a subprocess that was expected to run with reduced privileges to access files or resources available to the original process’s supplementary groups. Users are impacted if they rely on `_uid` as a privilege boundary when launching commands from a privileged parent process.</p> <p>### Patches Upgrade to version &gt;= 2.2.4</p> <p>### Workarounds Avoid using `_uid` when the user represents a less-privileged user.</p> https://cve.radiocsirt.org/vuln/brew-codelimit-cve-2026-54552 https://cve.radiocsirt.org/vuln/cve-2026-54552 <p><strong>Affected:</strong> amoffat sh</p> <p>sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process&#39;s supplementary groups because the privilege-drop sequence does not fully establish the target user&#39;s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.</p> <p><strong>Affected:</strong> amoffat sh</p> <p>sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process&#39;s supplementary groups because the privilege-drop sequence does not fully establish the target user&#39;s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-54552 https://cve.radiocsirt.org/vuln/ghsa-q38v-wp89-2w55 <p><strong>Affected:</strong> PyPI: sh</p> <p>### Impact The `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems.</p> <p>When `sh` was run from a process with elevated privileges, such as root, and a command was launched with `_uid=&lt;unprivileged user&gt;`, the child process changed its UID and primary GID but did not reset its supplementary groups. As a result, the child process could retain the parent process’s supplementary groups, potentially including privileged groups such as root, docker, disk, shadow, or sudo.</p> <p>This could allow a subprocess that was expected to run with reduced privileges to access files or resources available to the original process’s supplementary groups. Users are impacted if they rely on `_uid` as a privilege boundary when launching commands from a privileged parent process.</p> <p>### Patches Upgrade to version &gt;= 2.2.4</p> <p>### Workarounds Avoid using `_uid` when the user represents a less-privileged user.</p> <p><strong>Affected:</strong> PyPI: sh</p> <p>### Impact The `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems.</p> <p>When `sh` was run from a process with elevated privileges, such as root, and a command was launched with `_uid=&lt;unprivileged user&gt;`, the child process changed its UID and primary GID but did not reset its supplementary groups. As a result, the child process could retain the parent process’s supplementary groups, potentially including privileged groups such as root, docker, disk, shadow, or sudo.</p> <p>This could allow a subprocess that was expected to run with reduced privileges to access files or resources available to the original process’s supplementary groups. Users are impacted if they rely on `_uid` as a privilege boundary when launching commands from a privileged parent process.</p> <p>### Patches Upgrade to version &gt;= 2.2.4</p> <p>### Workarounds Avoid using `_uid` when the user represents a less-privileged user.</p> https://cve.radiocsirt.org/vuln/ghsa-q38v-wp89-2w55