CVE-2026-54552
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The sh library before version 2.2.4 incompletely drops privileges when using the _uid option on Linux and Unix systems. A process running with elevated privileges can retain the parent's supplementary groups, allowing the child to access files and resources reserved for privileged groups such as root, docker, disk, shadow, or sudo.
Risk Assessment
The organization is exposed to privilege escalation because a process running with a lower UID may still have access to sensitive system resources, potentially leading to unauthorized data access or system compromise.
Recommendation
It is recommended to immediately upgrade the sh library to version 2.2.4 or later, which fully implements privilege dropping.
Original NVD description (English source)
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.