Hi,

The following vulnerability was published for python-sh.

CVE-2026-54552[0]:
| sh provides Python process launching. Prior to 2.2.4, the _uid
| option in sh.py performs an incomplete privilege drop on Linux and
| Unix-like systems. When sh runs from an elevated process and
| launches a command with _uid set to an unprivileged user, the child
| changes its UID but can retain the parent process's supplementary
| groups because the privilege-drop sequence does not fully establish
| the target user's UID, primary GID, and supplementary groups. The
| child can therefore retain access to files or resources granted to
| privileged groups such as root, docker, disk, shadow, or sudo,
| violating the expected _uid privilege boundary. This issue is fixed
| in version 2.2.4.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-54552
https://www.cve.org/CVERecord?id=CVE-2026-54552
[1] https://github.com/amoffat/sh/security/advisories/GHSA-q38v-wp89-2w55
[2] https://github.com/amoffat/sh/pull/776
[3] https://github.com/amoffat/sh/commit/3d855daba91f87a089b490c0d1cf1df3faace2f1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore