CVE-2026-63349High· 7.0▾ TwilightAnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_proce…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.1%
Last analysed / modified upstream
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
anyio >= 4.14.0, < 4.14.2Patched in:
anyio 4.14.2Source: https://github.com/advisories/GHSA-3w57-8xmc-8v26
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63374Critical· 9.3AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio
CVE-2026-64847Medium· 6.8AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio
CVE-2026-102676High· 8.3Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2025-38466High· 7.8In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction
CVE-2026-108575Medium· 6.3A vulnerability has been found in BerriAI LiteLLM up to 1.94.0
CVE-2026-15218High· 7.9A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI