Skip to content
OpenAdvisories

Package · Debian

python-sh

1 known vulnerabilities.

All Critical High Medium Low Exploited only

1 result · Feed

  • High 7.9
    CVE-2026-54552

    sh _uid does not drop supplementary groups (incomplete privilege drop)

    sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child …

    amoffat sh python-sh sh Debian Ubuntu PyPI