CVE-2026-54552 in amoffat
Summary
by MITRE • 08/18/2026
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The sh library serves as a popular Python interface for executing shell commands and managing subprocesses within application workflows. A critical security flaw was identified in versions prior to 2.2.4 regarding the handling of user identity during process execution, specifically when utilizing the _uid parameter intended to drop privileges before launching external processes. This vulnerability stems from an incomplete implementation of privilege dropping mechanisms on Linux and Unix-like operating systems where the library fails to properly reset all aspects of the process security context. When a Python script running with elevated permissions invokes sh to execute a command under a different user identity, the resulting child process correctly changes its User ID but neglects to fully reinitialize the group membership structure associated with that target user.
The technical root cause lies in the sequence used to establish the new process credentials. The implementation modifies the effective and real UIDs but does not call the necessary system calls to clear supplementary groups or set the primary GID according to the passwd database entry for the specified unprivileged user. Consequently, the child process inherits the parent's supplementary group list rather than adopting the default groups assigned to the target account. This behavior creates a significant discrepancy between the intended security boundary and the actual runtime environment of the spawned process. The flaw effectively allows an attacker who can control or influence the _uid parameter in a privileged context to bypass expected access controls by leveraging retained high-privilege group memberships such as root, docker, disk, shadow, or sudo.
The operational impact of this vulnerability is severe because it enables privilege escalation through group-based permissions rather than direct UID manipulation. Many system resources and sensitive files are protected not only by user ownership but also by group membership policies. For instance, the docker group typically grants unrestricted access to the Docker daemon socket, allowing container escape or host compromise if retained in a non-privileged context. Similarly, retention of shadow or sudo groups can facilitate unauthorized reading of password hashes or execution of commands with elevated privileges via sudoers rules that rely on group-based allowances. This violates the principle of least privilege and undermines security models that depend on strict isolation between privileged administrative tasks and unprivileged application logic.
This vulnerability aligns closely with CWE-250, which describes executing code with unnecessary privileges, as well as CWE-732, concerning incorrect permission assignment for critical resources. From a threat modeling perspective using the MITRE ATT&CK framework, this flaw facilitates lateral movement and privilege escalation techniques where an adversary leverages existing group memberships to gain higher-level access without exploiting traditional buffer overflows or injection flaws. It represents a logic error in security control implementation rather than a memory corruption issue, making it particularly dangerous as static analysis tools may not easily detect the missing system calls required for proper credential reset.
To mitigate this risk, organizations must immediately upgrade the sh library to version 2.2.4 or later where the privilege drop sequence has been corrected to properly set the UID, primary GID, and clear supplementary groups before executing external commands. For environments that cannot update dependencies instantly, developers should implement manual security hardening by explicitly calling os.setgroups with an empty list after changing UIDs if they must rely on older versions of the library for critical operations involving untrusted inputs or elevated contexts. Additionally, adopting defense-in-depth strategies such as running application processes in containers with restricted capabilities and using mandatory access control systems like SELinux or AppArmor can help contain potential breaches resulting from incomplete privilege separation within Python subprocesses.