🚨 HIGH - Incomplete privilege drop via retained supplementary groups in sh _uid option (CVE-2026-54552) CVE-2026-54552 is a privilege management flaw in the sh Python package where the _uid option on Linux/Unix changes the process UID and primary GID but fails to clear supplementary groups. The root cause is incomplete privilege dropping / improper privilege management (supplementary groups not reset). An attacker can exploit this when a privileged parent process (root or service account with powerful groups) spawns a child with _uid expecting reduced privileges, but the child retains privileged supplementary groups like docker, disk, shadow, or sudo. Impact is unintended access to sensitive resources and potential privilege escalation paths via group-granted capabilities (e.g., reading protected files, accessing Docker socket, or interacting with device nodes). 👉 Affected: sh < 2.2.4 | Upgrade to 2.2.4+
Post summary
The vulnerability CVE-2026-54552 in sh Python causes incomplete privilege dropping via retained supplementary groups; upgrading to version 2.2.4+ resolves this issue.