{"id":"GHSA-3w57-8xmc-8v26","summary":"AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups","details":"AnyIO 4.14.0 accepts the POSIX extra_groups argument on anyio.run_process() and anyio.open_process(), but open_process() forwards the wrong variable to the backend: when extra_groups is not None, it assigns kwargs[\"extra_groups\"] = group instead of extra_groups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extra_groups=[]) clears a synthetic parent supplementary group list, while anyio.run_process(..., extra_groups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extra_groups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.","aliases":["CVE-2026-63349"],"modified":"2026-09-18T17:30:08.928812103Z","published":"2026-09-18T17:17:23Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-266","CWE-269"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-09-18T17:17:23Z"},"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1209"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"}],"affected":[{"package":{"name":"anyio","ecosystem":"PyPI","purl":"pkg:pypi/anyio"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.0"},{"fixed":"4.14.2"}]}],"versions":["4.14.0","4.14.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-3w57-8xmc-8v26/GHSA-3w57-8xmc-8v26.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}