CVE-2026-61897

A flaw was found in AccountsService. An Ubuntu-specific patch for AccountsService did not fully drop root privileges when launching language helper scripts. This oversight allows a local user to exploit the incomplete privilege drop, potentially enabling them to reset their effective user ID to...

Linux Distros Unpatched Vulnerability : CVE-2026-54552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs...

CVE-2026-61897

An Ubuntu-specific AccountsService patch before 23.13.9-8ubuntu7 changes only the effective UID/GID to the target user while leaving the real UID as root (0). A shell spawned by a language helper script inherits ruid=0 and can reset its effective UID to root, enabling local privilege escalation t...

CVE-2026-54552

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

CVE-2026-54552

The Python sh library's _uid option performs an incomplete privilege drop: child processes retain parent supplementary groups (root, docker, disk, shadow, sudo), enabling privilege escalation. Fixed in sh 2.2.4 ; SUSE/SUSE Linux Enterprise and openSUSE Leap patches (SUSE-SU-2026:3422-1, openSUSE-...

EUVD-2026-61127

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

CVE-2026-54552 sh _uid does not drop supplementary groups (incomplete privilege drop)

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

CVE-2026-54552 sh _uid does not drop supplementary groups (incomplete privilege drop)

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

openSUSE 16 Security Update : python-sh (openSUSE-SU-2026:21516-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21516-1 advisory. This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and...

Security update for python-sh (important)

openSUSE security update: security update for python-sh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21516-1 Rating: important References: bsc1272424 Cross-References: CVE-2026-54552 CVSS scores: CVE-2026-54552 SUSE : 8.2...

SUSE-SU-2026:23134-1 Security update for python-sh

This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and allows for privilege escalation bsc1272424...

SUSE-SU-2026:23112-1 Security update for python-sh

This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and allows for privilege escalation bsc1272424...

OPENSUSE-SU-2026:21516-1 Security update for python-sh

This update for python-sh fixes the following issue - CVE-2026-54552: uid option performs an incomplete privilege drop on Linux/Unix-like systems and allows for privilege escalation bsc1272424...

SUSE SLED15 / SLES15 Security Update : python-sh (SUSE-SU-2026:3422-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3422-1 advisory. - CVE-2026-54552: incomplete privilege drop in the uid option can allow a subprocess to retain parent supplementary...

SUSE-SU-2026:3422-1 Security update for python-sh

This update for python-sh fixes the following issues: - CVE-2026-54552: incomplete privilege drop in the uid option can allow a subprocess to retain parent supplementary groups bsc1272424...

CVE-2026-16743

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...

EUVD-2026-48570

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...

CVE-2026-16743

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...

CVE-2026-16743

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...

PT-2026-64293

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the...