amoffat sh up to 2.2.3 sh.py _uid privileges management

Summaryinfo

A vulnerability, which was classified as problematic, has been found in amoffat sh up to 2.2.3. Affected by this vulnerability is an unknown functionality of the file sh.py. Performing a manipulation of the argument _uid results in privileges management. This vulnerability is known as CVE-2026-54552. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability was found in amoffat sh up to 2.2.3. It has been classified as problematic. This affects an unknown functionality of the file sh.py. The manipulation of the argument _uid with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54552 since 06/15/2026. The exploitability is told to be easy. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 2.2.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• amoffat

Name

• sh

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3

Website

• Product: https://github.com/amoffat/sh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion