Threats tagged 'brew-fastapi-cve-2026-63349'

AnyIO versions 4.14.0 used by FastAPI have a vulnerability in the handling of the extra_groups argument in run_process() and open_process() functions. The open_process() function incorrectly forwards the extra_groups parameter, causing child processes to retain parent supplementary groups instead of properly clearing or setting them. This affects privilege dropping on POSIX systems, potentially allowing child processes to run with unintended group privileges. The issue is fixed in AnyIO version 0.139.1.