PyPI/sh CVE-2026-54552: high 7.9, EPSS 0.17%

sh _uid does not drop supplementary groups (incomplete privilege drop)

Action: Upgrade sh to 2.2.4 or later.

pip install sh==2.2.4

Affected

Fixed versions

Sources

• osv: GHSA-q38v-wp89-2w55
• https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55
• https://github.com/amoffat/sh
• https://github.com/amoffat/sh/releases/tag/2.2.4

CVE-2026-54552 · published 2026-07-17T18:41:38Z · modified 2026-07-23T15:11:41.199641724Z · JSON