sh vulnerabilities

CVEs whose affected-version data names the sh package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-54552High· 7.9

1mo ago

sh provides Python process launching

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivi…

▾ Twilightsh · shEPSS 0.13%via NVD