sh _uid does not drop supplementary groups (incomplete privilege drop)
Impact
The _uid option performed an incomplete privilege drop on Linux/Unix-like systems.
When sh was run from a process with elevated privileges, such as root, and a command was launched with _uid=<unprivileged user>, the child process changed its UID and primary GID but did not reset its supplementary groups. As a result, the child process could retain the parent process’s supplementary groups, potentially including privileged groups such as root, docker, disk, shadow, or sudo.
This could allow a subprocess that was expected to run with reduced privileges to access files or resources available to the original process’s supplementary groups. Users are impacted if they rely on _uid as a privilege boundary when launching commands from a privileged parent process.
Patches
Upgrade to version >= 2.2.4
Workarounds
Avoid using _uid when the user represents a less-privileged user.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | sh | < 2.2.4 | 2.2.4 |
References
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N- Weakness (CWE)
CWE-273- Platform
- Python (PyPI)
- Package
sh- Disclosed
- 17.07.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3540 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-q38v-wp89-2w55 - CC BY 4.0
Vulnerability history: sh
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.