CVE-2026-54552High· 7.9▾ Twilightsh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 43.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
sh < 2.2.4Patched in:
sh 2.2.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80047High· 7.8Hugging Face Transformers library writes remote code to disk prior to consent check
CVE-2023-52433High· 7.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends
CVE-2026-0099High· 7.8In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code
CVE-2026-35370Medium· 4.4id: groups= computed from real GID instead of effective GID