CVE-2026-63349

A flaw was found in AnyIO. When launching child processes using anyio.openprocess, the extragroups argument is incorrectly handled. This can allow a less-privileged child process to retain the supplementary groups of its parent, potentially leading to unintended privilege retention. This issue...

CVE-2026-63349: Incorrect Privilege Assignment

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...