What is the CVSS score of CVE-2026-21882?

CVE-2026-21882 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-21882?

Within 24 hours: Inventory all systems running theshit and identify affected versions (up to 0.2.0). Within 7 days: Disable theshit on non-critical systems, restrict its usage to trusted administrators only, and implement principle of least privilege by removing unnecessary sudo/administrative access from the utility. Within 30 days: Monitor vendor communications for patch availability; evaluate alternative command-correction tools; conduct security review of any systems where theshit processed untrusted input.

CVE-2026-21882

HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-03-02 security-advisories@github.com

GHSA-2j3p-gqw5-g59j

Privilege Escalation

8.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 20:16 nvd

HIGH 8.4

DescriptionGitHub Advisory

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.

AnalysisAI

Local privilege escalation in theshit command-line utility versions prior to 0.2.0 allows unprivileged users to execute arbitrary commands with elevated privileges through improper privilege dropping during command re-execution. An attacker with local access can exploit this vulnerability to gain root or elevated system access. No patch is currently available.

Technical ContextAI

This vulnerability (CWE-250: Execution with Unnecessary Privileges) affects theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands.. theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.