Privilege Escalation Vulnerability in sh Python Library by Amoffat

CVE-2026-54552

What is CVE-2026-54552?

A privilege escalation vulnerability exists in the sh library, prior to version 2.2.4, affecting Linux and Unix-like systems. When sh is executed from a process with elevated privileges, it can launch commands under an unprivileged user. However, due to an incomplete privilege drop mechanism, the child process may retain its parent process's supplementary group access. This flaw allows the child process to potentially interact with resources and files that it normally shouldn't have access to, like those granted to privileged groups (e.g., root, docker, disk, shadow, or sudo). This undermines the intended privilege separation and security boundaries that the _uid option aims to enforce.

References