sh (Python) EUVD-2026-61127

Requires a Linux/Unix host where a privileged parent process (typically root) invokes sh with the _uid=<unprivileged user> option AND relies on _uid as its privilege boundary, while that root process is itself a member of powerful supplementary groups such as docker, disk, shadow, sudo, or root. The attacker must control the code or command executed in the supposedly-reduced subprocess. Exploitation is limited to sh versions < 2.2.4; it does not apply if _uid is unused, if the parent is not privileged, if the parent carries no sensitive supplementary groups, or on non-Unix platforms. There is no remote or network exposure and no unauthenticated path.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, 7.9 High) is internally consistent: exploitation is local and low-complexity but requires a high-privilege context (a root parent using _uid), with a scope change reflecting the crossed privilege boundary and high confidentiality/integrity impact. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low and opportunistic rather than mass-scale - this is a latent privilege-boundary weakness dangerous only in deployments that specifically use _uid as a security boundary from a privileged parent. The key limiting factor is that a developer must already run sh as root and rely on _uid for isolation; environments not using _uid this way are unaffected. Priority is elevated for container/orchestration tooling that shells out as root but moderate overall given the narrow prerequisite.

A daemon running as root uses sh with _uid to execute a plugin or user-supplied command as an unprivileged account, trusting _uid to sandbox it. Because supplementary groups are never cleared, the command still belongs to the docker group and mounts a container bind-mounting the host filesystem, or belongs to shadow and reads /etc/shadow - achieving full host compromise despite the reduced UID. No public POC is known, but the technique is straightforward for anyone controlling the launched command.