sh uses Python to launch subprocesses, and the _uid parameter is intended to drop privileges when invoking a command. Prior to release 2.2.4, the privilege‑drop routine does not fully reset the child process’s supplementary groups, leaving it with the parent’s group membership. When a high‑privilege process calls sh with _uid set to an unprivileged user, the resulting child can maintain membership in privileged groups such as root, docker, disk, shadow, or sudo, thereby bypassing the expected permission boundary and enabling access to files or services granted only to those groups. This failure constitutes a vulnerability described by CWE‑273, Elevation of Privilege.

The affected product is sh by amoffat. Versions older than 2.2.4 contain the incomplete privilege drop logic; version 2.2.4 and later include the fix.

The CVSS score of 7.9 marks this flaw as high severity. EPSS information is not available, and it is not listed in CISA’s KEV catalog. The most likely attack vector is a local or container‑based attacker who can run sh from an already‑elevated process. Once sh is invoked with the _uid option, the child process inherits the parent’s supplementary groups, allowing the attacker to access resources and files that should be protected by group permissions, effectively escalating privileges within the host. The impact is therefore a potential unauthorized access to privileged resources, while the exploitation requires the attacker to control the launching process.