CVE-2026-21882
HIGH
GHSA-2j3p-gqw5-g59j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser executes theshit command
-
ExploitUtility fails to drop privileges properly
-
ExecutionMalicious command re-executed with elevated permissions
-
ImpactArbitrary code execution as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Local access to system running theshit versions prior to 0.2.0. Attacker must be able to invoke the theshit utility locally. No authentication required on the local system. |
| Impact | CVSS 8.4 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: None. Exploitable via local access. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Local privilege escalation in theshit command-line utility versions prior to 0.2.0 allows unprivileged users to execute arbitrary commands with elevated privileges through improper privilege dropping during command re-execution. An attacker with local access can exploit this vulnerability to gain root or elevated system access. No patch is currently available.
Earlier versions of this analysis (1)
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. versions up to 0.2.0 is affected by execution with unnecessary privileges (CVSS 8.4).
RemediationAI
Fixed in version 0.2.0..
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-250: Execution with Unnecessary Privileges) affects theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands.. theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.
Executive ViewAI
CVE-2026-21882 affects theshit command-line utility versions up to 0.2.0, allowing attackers to execute arbitrary commands with elevated privileges. This vulnerability poses a significant risk to any organization using this tool, particularly in environments where developers or system administrators run untrusted or malicious shell commands that could be intercepted and executed with unnecessary elevated permissions.
Since no patch is currently available: (1) Remove unnecessary SUID/SGID bits if present; (2) Restrict execution permissions to root or trusted user groups only; (3) Disable theshit entirely on systems handling untrusted input or user-supplied commands; (4) Implement strict file integrity monitoring on systems running the utility; (5) Apply network-level controls to limit lateral movement if compromise occurs; (6) Audit audit logs for any suspicious theshit execution patterns; (7) Avoid using theshit in automated scripts that process external input.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB