AnyIO is an asynchronous concurrency framework that supports subprocess management on POSIX systems. In versions 4.14.0 and 4.14.1, the anyio.open_process() function incorrectly forwards the group argument instead of the extra_groups argument to the backend process launcher. When a caller attempts to clear inherited supplementary groups by passing extra_groups=[], the child process instead inherits the parent's supplementary groups, undermining intended privilege restrictions. Additionally, if the group argument is supplied as an integer where an iterable is expected, the launch may fail with a TypeError. This vulnerability affects POSIX applications relying on AnyIO subprocess helpers to drop privileges in child processes. The issue is resolved in AnyIO version 4.14.2.

Child processes launched using anyio.open_process() in affected versions may retain supplementary groups from the parent process, potentially allowing elevated privileges or access beyond intended restrictions. This undermines privilege-dropping mechanisms and could lead to unauthorized access or escalation within POSIX environments. The vulnerability requires high privileges to exploit and has a high complexity due to the need for privileged context and specific usage patterns.

Upgrade AnyIO to version 4.14.2 or later, where this issue is fixed. Until then, avoid relying on anyio.open_process() with the extra_groups argument to drop supplementary groups on POSIX systems. No other mitigations are documented.