THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-3w57-8xmc-8v26 (high) — AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

[GHSA] GHSA-3w57-8xmc-8v26 (high) — AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

medgithub_advisoriesPublished 2026-09-18

GHSA-3w57-8xmc-8v26 Severity: high CVE: CVE-2026-63349

AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of

Indicators of compromise

Original source: https://github.com/advisories/GHSA-3w57-8xmc-8v26