Executive brief
AnyIO is a Python library for asynchronous I/O that provides subprocess management helpers. A bug in versions 4.14.0–4.14.1 prevents the extra_groups parameter from working correctly when launching child processes, potentially leaving privileged supplementary group memberships intact that should have been dropped. Applications relying on AnyIO to launch less-privileged child processes may fail to properly restrict those processes' capabilities.
Technical details
The vulnerability is a privilege management bug in AnyIO's open_process() function. When the extra_groups parameter is provided to set or clear supplementary groups, the function incorrectly assigns kwargs["extra_groups"] = group instead of kwargs["extra_groups"] = extra_groups, passing the wrong variable to the backend. This causes child processes to retain the parent's supplementary group memberships instead of having them modified as requested. If both group and extra_groups are supplied, an integer is passed where a list is expected, resulting in TypeError. This is a POSIX-specific correctness issue affecting privilege-dropping scenarios. The bug affects versions 4.14.0 through 4.14.1 and is patched in version 4.14.2.
Affected products
- Alex Gronholm AnyIO 4.14.0 to 4.14.1
Timeline
- 2026-07-07: disclosed
- 2026-09-18: patched: Version 4.14.2 released