Action not permitted
Modal body text goes here.
Modal Title
Modal Body
GHSA-3W57-8XMC-8V26
Vulnerability from github – Published: 2026-09-18 17:17 – Updated: 2026-09-18 17:17AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "anyio"
},
"ranges": [
{
"events": [
{
"introduced": "4.14.0"
},
{
"fixed": "4.14.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63349"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-18T17:17:23Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "GHSA-3w57-8xmc-8v26",
"modified": "2026-09-18T17:17:23Z",
"published": "2026-09-18T17:17:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups"
}
BREW-PIECES-CLI-CVE-2026-63349 (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-20 10:59 – Updated: 2026-09-20 10:59 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.15.1",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "pieces-cli",
"purl": "pkg:brew/pieces-cli"
},
"ranges": [
{
"events": [
{
"introduced": "1.20.1_7"
},
{
"fixed": "1.20.1_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.15.1",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.15.1"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-pieces-cli-CVE-2026-63349",
"modified": "2026-09-20T10:59:59Z",
"published": "2026-09-20T10:59:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-POETRY-CVE-2026-63349 (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-19 11:35 – Updated: 2026-09-19 11:35 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.15.0",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "poetry",
"purl": "pkg:brew/poetry"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.1_4"
},
{
"fixed": "2.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.15.0",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.15.0"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-poetry-CVE-2026-63349",
"modified": "2026-09-19T11:35:10Z",
"published": "2026-09-19T11:35:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-POSTING-CVE-2026-63349 (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-20 11:01 – Updated: 2026-09-20 11:01 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.15.1",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "posting",
"purl": "pkg:brew/posting"
},
"ranges": [
{
"events": [
{
"introduced": "2.10.0_2"
},
{
"fixed": "2.10.0_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.15.1",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.15.1"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-posting-CVE-2026-63349",
"modified": "2026-09-20T11:01:55Z",
"published": "2026-09-20T11:01:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-PROWLER-CVE-2026-63349 (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-18 17:39 – Updated: 2026-09-18 17:39 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.15.1",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "prowler",
"purl": "pkg:brew/prowler"
},
"ranges": [
{
"events": [
{
"introduced": "5.30.2"
},
{
"fixed": "5.31.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.15.1",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.15.1"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-prowler-CVE-2026-63349",
"modified": "2026-09-18T17:39:10Z",
"published": "2026-09-18T17:39:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-SAFETY-CVE-2026-63349 (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-18 18:16 – Updated: 2026-09-18 18:16 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.14.2",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "safety",
"purl": "pkg:brew/safety"
},
"ranges": [
{
"events": [
{
"introduced": "3.8.1_1"
},
{
"fixed": "3.8.1_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.14.2",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.14.2"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-safety-CVE-2026-63349",
"modified": "2026-09-18T18:16:14Z",
"published": "2026-09-18T18:16:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-SCHEMATHESIS-CVE-20… (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-18 18:21 – Updated: 2026-09-18 18:21 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.15.1",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "schemathesis",
"purl": "pkg:brew/schemathesis"
},
"ranges": [
{
"events": [
{
"introduced": "4.21.8"
},
{
"fixed": "4.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.15.1",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.15.1"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-schemathesis-CVE-2026-63349",
"modified": "2026-09-18T18:21:12Z",
"published": "2026-09-18T18:21:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-SEMGREP-CVE-2026-63349 (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-20 11:10 – Updated: 2026-09-20 11:10 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.14.2",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "semgrep",
"purl": "pkg:brew/semgrep"
},
"ranges": [
{
"events": [
{
"introduced": "1.167.0"
},
{
"fixed": "1.170.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.14.2",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.14.2"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-semgrep-CVE-2026-63349",
"modified": "2026-09-20T11:10:12Z",
"published": "2026-09-20T11:10:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-SNYK-AGENT-SCAN-CVE… (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-20 11:22 – Updated: 2026-09-20 11:22 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.15.1",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "snyk-agent-scan",
"purl": "pkg:brew/snyk-agent-scan"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.11"
},
{
"fixed": "0.5.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.15.1",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.15.1"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-snyk-agent-scan-CVE-2026-63349",
"modified": "2026-09-20T11:22:16Z",
"published": "2026-09-20T11:22:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-STRANDS-AGENTS-SOPS… (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-20 11:32 – Updated: 2026-09-20 11:32 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.15.1",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "strands-agents-sops",
"purl": "pkg:brew/strands-agents-sops"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.2_5"
},
{
"fixed": "1.1.2_6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.15.1",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.15.1"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-strands-agents-sops-CVE-2026-63349",
"modified": "2026-09-20T11:32:27Z",
"published": "2026-09-20T11:32:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
BREW-SYSAIDMIN-CVE-2026-63349 (GHSA-3W57-8XMC-8V26)
Vulnerability from osv_homebrew – Published: 2026-09-18 18:57 – Updated: 2026-09-18 18:57 – Source websiteAnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs["extra_groups"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "anyio",
"resource_purl": "pkg:pypi/anyio@4.14.2",
"upstream_fixed_in": "4.14.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "sysaidmin",
"purl": "pkg:brew/sysaidmin"
},
"ranges": [
{
"events": [
{
"introduced": "0.2.5_18"
},
{
"fixed": "0.2.5_19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/anyio@4.14.2",
"name": "anyio",
"resource": "anyio",
"strategy": "registry",
"subject_version": "4.14.2"
}
]
},
"details": "AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python\u0027s subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.",
"id": "BREW-sysaidmin-CVE-2026-63349",
"modified": "2026-09-18T18:57:50Z",
"published": "2026-09-18T18:57:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/pull/1209"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/anyio"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups",
"upstream": [
"GHSA-3w57-8xmc-8v26",
"CVE-2026-63349"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.