Privilege Boundary Issue in AnyIO Framework by Agronholm
CVE-2026-63349
What is CVE-2026-63349?
The AnyIO framework, which supports high-level asynchronous concurrency and networking, presents a vulnerability in version 4.14.0 concerning the handling of the POSIX extra_groups argument within its subprocess methods. Specifically, the anyio.open_process() function mistakenly forwards the group argument to the backend rather than respecting the extra_groups. This flaw allows a process to inherit parent process group permissions despite the intention to drop them, which could potentially lead to security risks. Moreover, if a group value is supplied simultaneously, a TypeError may occur due to the expectation of an iterable instead of an integer. This vulnerability primarily affects POSIX applications employing AnyIO subprocess helpers to create child processes with reduced privileges. Version 4.14.2 addresses the issue, restoring expected functionality and security.
Affected Version(s)
anyio >= 4.14.0, < 4.14.2