{"action":"Upgrade sh to 2.2.4 or later.","affected":[{"fixed":"2.2.4","introduced":"0"}],"component":"sh","cve_ids":["CVE-2026-54552"],"ecosystem":"PyPI","epss":0.00169,"exploited":false,"fixed_versions":["2.2.4"],"ghsa_id":"GHSA-q38v-wp89-2w55","id":"tcs_01M5KH5XYDQ234APEXEWHZ6X67","modified_at":"2026-07-23T15:00:23.844332272Z","published_at":"2026-07-23T11:41:46.915478Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3540","https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55","https://github.com/amoffat/sh","https://github.com/amoffat/sh/releases/tag/2.2.4","https://pypi.org/project/sh","https://github.com/advisories/GHSA-q38v-wp89-2w55","https://nvd.nist.gov/vuln/detail/CVE-2026-54552"],"severity":{"label":"high","score":7.9},"sources":[{"source":"osv","source_id":"PYSEC-2026-3540","url":"https://osv.dev/vulnerability/PYSEC-2026-3540"}],"summary":"sh _uid does not drop supplementary groups (incomplete privilege drop)"}