CVE-2026-63349
2 advisories.
PyPI/anyio CVE-2026-63349: high, EPSS 0.11%
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
Action: Upgrade anyio to 4.14.2 or later.
pip install anyio==4.14.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.14.0 | 4.14.2 | - |
Fixed versions
| 4.14.2 |
Sources
- osv: GHSA-3w57-8xmc-8v26
- https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26
- https://github.com/agronholm/anyio/pull/1209
- https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200
- https://github.com/agronholm/anyio
- https://github.com/agronholm/anyio/releases/tag/4.14.2
CVE-2026-63349 · published · modified · JSON
PyPI/anyio CVE-2026-63349: unknown, EPSS 0.11%
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
Action: Upgrade anyio to 4.14.2 or later.
pip install anyio==4.14.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.14.0 | 4.14.2 | - |
Fixed versions
| 4.14.2 |
Sources
- osv: PYSEC-2026-4023
- https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26
- https://github.com/agronholm/anyio/pull/1209
- https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200
- https://github.com/agronholm/anyio
- https://github.com/agronholm/anyio/releases/tag/4.14.2
- https://pypi.org/project/anyio
- https://github.com/advisories/GHSA-3w57-8xmc-8v26
- https://nvd.nist.gov/vuln/detail/CVE-2026-63349
CVE-2026-63349 · published · modified · JSON