TI-2026-39391 CVE-2026-54552 · GHSA-q38v-wp89-2w55sh _uid does not drop supplementary groups (incomplete privilege drop)Priority LOW 36sh provides Python process launching.CVSS 3.1HIGH 7.9· Local · High privileges · No interaction · EPSS 0.00169 · Published 2026-08-18 · Fixed in 2.2.4 CWE-273