PyPI/anyio CVE-2026-63349: high 7, EPSS 0.11%

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

Action: Upgrade anyio to 4.14.2 or later.

pip install anyio==4.14.2

Affected

Fixed versions

Sources

• osv: GHSA-3w57-8xmc-8v26
• nvd: CVE-2026-63349
• https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26
• https://github.com/agronholm/anyio/pull/1209
• https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200
• https://github.com/agronholm/anyio
• https://github.com/agronholm/anyio/releases/tag/4.14.2

CVE-2026-63349 · published 2026-09-18T17:17:23Z · modified 2026-10-01T17:56:12.703459176Z · JSON