CVE-2026-54552
2 advisories.
PyPI/sh CVE-2026-54552: high 7.9
sh _uid does not drop supplementary groups (incomplete privilege drop)
Action: Upgrade sh to 2.2.4 or later.
pip install sh==2.2.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.2.4 | - |
Fixed versions
| 2.2.4 |
Sources
- osv: GHSA-q38v-wp89-2w55
- https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55
- https://github.com/amoffat/sh
- https://github.com/amoffat/sh/releases/tag/2.2.4
CVE-2026-54552 · published · modified · JSON
PyPI/sh CVE-2026-54552: high 7.9
sh _uid does not drop supplementary groups (incomplete privilege drop)
Action: Upgrade sh to 2.2.4 or later.
pip install sh==2.2.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.2.4 | - |
Fixed versions
| 2.2.4 |
Sources
- osv: PYSEC-2026-3540
- https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55
- https://github.com/amoffat/sh
- https://github.com/amoffat/sh/releases/tag/2.2.4
- https://pypi.org/project/sh
- https://github.com/advisories/GHSA-q38v-wp89-2w55
- https://nvd.nist.gov/vuln/detail/CVE-2026-54552
CVE-2026-54552 · published · modified · JSON