Threats tagged 'brew-fastmcp-cve-2026-63349'

AnyIO versions from 3.4.2_2 up to but not including 3.4.5 contain a vulnerability where the extra_groups argument in run_process() and open_process() is mishandled. This causes child processes to retain parent supplementary groups instead of properly clearing or setting them, leading to a POSIX privilege-dropping correctness issue. The flaw can cause TypeError if both group and extra_groups are supplied. A fix is available in version 3.4.5.