CVE-2026-54552

What it is

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

At a glance

Exploitability

Can be exploited locally on the machine with an admin-level account. High risk of data exposure, data tampering.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-18 18:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-22 22:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-18 18:18 UTC

Last modified

2026-10-22 22:10 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-273

Record status

Deferred

Attack profile CVSS 3.1 · 7.9

Attack vector

Local

Complexity

Low

Privileges needed

High

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None