Threats tagged 'brew-mcp-proxy-cve-2026-63349'

AnyIO versions from 0.12.0_3 up to but not including 0.12.0_4 contain a vulnerability in the handling of the POSIX extra_groups argument in run_process() and open_process(). The open_process() function incorrectly forwards the extra_groups parameter, causing child processes to retain parent supplementary groups instead of properly clearing or setting them. This leads to a privilege-dropping correctness issue on POSIX systems, potentially affecting applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. The issue is fixed in version 0.12.0_4.