Incomplete privilege drop in the Python `sh` package (CVE-2026-54552)

CVE-2026-54552 is an incomplete privilege drop vulnerability in the Python `sh` package affecting Linux/Unix-like systems. When the `_uid` option is used to launch a subprocess as a less-privileged user from an elevated parent process, the child process drops its UID and primary GID but retains the parent's supplementary groups, which may include privileged groups such as root, docker, disk, shadow, or sudo. This allows the subprocess to access files and resources beyond its intended privilege boundary. Affected versions: - < 2.2.4 We recommend updating to: 2.2.4. CVSS 7.9 · our assessment: this_week Vendor advisory: https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55 Details: https://vuln.today/cve/CVE-2026-54552