{"action":"Upgrade sh to 2.2.4 or later.","affected":[{"fixed":"2.2.4","introduced":"0"}],"component":"sh","cve_ids":["CVE-2026-54552"],"ecosystem":"PyPI","epss":0.00169,"exploited":false,"fixed_versions":["2.2.4"],"ghsa_id":"GHSA-q38v-wp89-2w55","id":"tcs_01M5KFV4X4XR9KX05J96BC769Z","modified_at":"2026-07-23T15:11:41.199641724Z","published_at":"2026-07-17T18:41:38Z","references":["https://osv.dev/vulnerability/GHSA-q38v-wp89-2w55","https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55","https://github.com/amoffat/sh","https://github.com/amoffat/sh/releases/tag/2.2.4"],"severity":{"label":"high","score":7.9},"sources":[{"source":"osv","source_id":"GHSA-q38v-wp89-2w55","url":"https://osv.dev/vulnerability/GHSA-q38v-wp89-2w55"}],"summary":"sh _uid does not drop supplementary groups (incomplete privilege drop)"}