---
id: CVE-2026-54552
title: sh provides Python process launching
summary: >-
  sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py
  performs an incomplete privilege drop on Linux and Unix-like systems. When sh
  runs from an elevated process and launches a command with _uid set to an
  unprivi…
severity: high
cvss: 7.9
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-273
vendor: sh
product: sh
affected:
  - sh < 2.2.4
patched:
  - sh 2.2.4
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54552'
references:
  - url: >-
      https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1
    label: security-advisories@github.com
  - url: 'https://github.com/amoffat/sh/pull/776'
    label: security-advisories@github.com
  - url: 'https://github.com/amoffat/sh/releases/tag/2.2.4'
    label: security-advisories@github.com
  - url: 'https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55'
    label: security-advisories@github.com
  - url: 'https://github.com/amoffat/sh'
tags:
  - nvd
  - osv
  - pip
epss: 0.00125
epssPercentile: 0.02531
aliases:
  - GHSA-q38v-wp89-2w55
ecosystem: pip
ingestedAt: '2026-07-17T19:00:50.892Z'
---

## Overview

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the target user's UID, primary GID, and supplementary groups. The child can therefore retain access to files or resources granted to privileged groups such as root, docker, disk, shadow, or sudo, violating the expected _uid privilege boundary. This issue is fixed in version 2.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54552)

Affected packages:

- `sh < 2.2.4`

Patched in:

- `sh 2.2.4`

Source: https://osv.dev/vulnerability/GHSA-q38v-wp89-2w55