{"apiVersion":"1.0","identifier":"CVE-2026-54552","description":"sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process-s supplementary groups because the privilege-drop sequence does not fully establish the target user-s UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.","publishedAt":"2026-08-18T18:18:23","lastModifiedAt":"2026-08-18T19:16:57","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54552","cvssScore":7.9,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","epssProbability":0.00125,"riskScore":0.8,"affectedProduct":"sh","affectedVersions":"<2.2.4","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-54552","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-54552","en":"https://www.redsauce.net/en/cves/CVE-2026-54552","fr":"https://www.redsauce.net/fr/cves/CVE-2026-54552","pt":"https://www.redsauce.net/pt/cves/CVE-2026-54552","de":"https://www.redsauce.net/de/cves/CVE-2026-54552","sk":"https://www.redsauce.net/sk/cves/CVE-2026-54552","el":"https://www.redsauce.net/el/cves/CVE-2026-54552"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-54552"}}