Threats tagged 'brew-otterdog-cve-2026-63349'

AnyIO version 4.14.0 has a vulnerability in its run_process() and open_process() functions where the extra_groups argument is mishandled. Specifically, open_process() incorrectly forwards the extra_groups parameter, causing child processes to retain parent supplementary groups instead of properly setting or clearing them. This affects privilege dropping on POSIX systems, potentially leading to incorrect privilege management in subprocesses. The issue is fixed in version 1.3.4_1 of the otterdog product.