CVE-2026-54552

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

CVE-2026-54552 sh _uid does not drop supplementary groups (incomplete privilege drop)

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

openSUSE 16 Security Update : python-sh (openSUSE-SU-2026:21516-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21516-1 advisory. This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and...

SUSE-SU-2026:23134-1 Security update for python-sh

This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and allows for privilege escalation bsc1272424...

SUSE-SU-2026:23112-1 Security update for python-sh

This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and allows for privilege escalation bsc1272424...

OPENSUSE-SU-2026:21516-1 Security update for python-sh

This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and allows for privilege escalation bsc1272424...

SUSE SLED15 / SLES15 Security Update : python-sh (SUSE-SU-2026:3422-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3422-1 advisory. - CVE-2026-54552: incomplete privilege drop in the uid option can allow a subprocess to retain parent supplementary...

arkindex-base-worker (>=0.3.2rc7, <=0.3.6rc1), disk-usage-exporter (>=0.0.1, <=0.1.0) +14 more potentially affected by CVE-2026-54552 via sh (>=2.0.2, <=2.2.2)

sh PYPI version =2.0.2, =0.3.2rc7, =0.0.1, =0.0.1, =1.0.0, =1.0.20, =0.0.2, =0.0.1, =0.8.9, =4.5.0, =23.10.20rc0, =0.1.6, =0.6.14, =0.1.5, =1.0.19, =1.0.20 and more Source cves: CVE-2026-54552 Source advisory: OSV:PYSEC-2026-3540...

ci-buildbot (>=0.4.0, <=0.11.5), molecule (>=3.0.5, <=3.1.5) +2 more potentially affected by CVE-2026-54552 via sh (1.13.1)

sh PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - ci-buildbot =0.4.0, =3.0.5, =0.0.0.dev0, =0.1.9, =0.1.12 Source cves: CVE-2026-54552 Source advisory: OSV:PYSEC-2026-3540...

enaml-native-cli (1.4.0) potentially affected by CVE-2026-54552 via sh (1.12.4)

sh PYPI version 1.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - enaml-native-cli 1.4.0 Source cves: CVE-2026-54552 Source advisory: OSV:GHSA-Q38V-WP89-2W55...

arkindex-base-worker (>=0.2.1, <=0.3.0rc5), candyshop (>=0.2.0, <=0.2.2) +8 more potentially affected by CVE-2026-54552 via sh (1.14.2)

sh PYPI version 1.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - arkindex-base-worker =0.2.1, =0.2.0, =0.0.2, =4.3.0a1, =0.1.1.1, =1.0.1, =2.0.0rc3, =2.0.0rc4 Source cves: CVE-2026-54552 Source advisory:...

arkindex-base-worker (>=0.1.11, <=0.2.1b2), assignment-autograder (>=2.12.0, <=2.18.1) +7 more potentially affected by CVE-2026-54552 via sh (1.14.1)

sh PYPI version 1.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - arkindex-base-worker =0.1.11, =2.12.0, =0.15.0, =0.1.0, =0.2.5, =1.0.0a0, =0.3.3, =0.3.0, =2.1.1a0 - zillionare-pluto 0.2.0 Source cves: CVE-2026-54552...

debpackager (>=0.1.0, <=0.2.1), freedom (>=0.0.0_21_g3038804_dirty, <=0.0.1) +6 more potentially affected by CVE-2026-54552 via sh (1.11.0)

sh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - debpackager =0.1.0, =0.0.021g3038804dirty, =0.6.0, =0.0.0, =0.1.0, =0.9.1, =0.9.6 - xenon 0.3.3 Source cves: CVE-2026-54552 Source advisory:...