CVE-2026-54552
Received Received - Intake

Privilege Escalation in sh Python Library via Incomplete UID Drop

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-54552
EUVD
EUVD-2026-61127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amoffat sh to 2.2.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-273 The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the Python package 'sh' (versions before 2.2.4) involves an incomplete privilege drop when using the _uid option. When a command runs with _uid set to an unprivileged user from a privileged parent process, the child process changes its UID and primary GID but fails to reset supplementary groups. This means the child retains the parent's privileged groups like root or docker, allowing access to restricted resources.

Detection Guidance

To detect this vulnerability, check if your system uses the 'sh' Python package version prior to 2.2.4. Run: pip show sh or pip list | grep sh. If the version is below 2.2.4, the system is vulnerable. Additionally, review code using the _uid option in the sh package to confirm privilege separation failures.

Impact Analysis

If you use the 'sh' package with _uid for privilege separation, an attacker could exploit this to gain unauthorized access to sensitive files or resources. This could lead to data breaches, privilege escalation, or system compromise, depending on the privileges of the parent process.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict privilege separation and access controls, such as GDPR's data protection principles or HIPAA's access control safeguards. Unauthorized access risks may lead to regulatory penalties or data exposure.

Mitigation Strategies

Immediately upgrade the 'sh' package to version 2.2.4 or later using pip install --upgrade sh. If upgrading is not possible, avoid using the _uid option for privilege separation as a temporary workaround. Review all scripts using this package to ensure proper privilege handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart