CVE-2026-63349: AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess() and anyio.openprocess(), but openprocess() forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs["extragroups"] = group instead of extragroups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extragroups=[]) clears a synthetic parent supplementary group list, while anyio.runprocess(..., extragroups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extragroups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
Other sources
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess() and anyio.openprocess(), but openprocess() forwards the group argument to the backend instead of extragroups. A caller that supplies extragroups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/anyioto a version that resolves this vulnerability.Fixed in 4.14.2 - Upgrade
Upgrade
AnyIOto a version that resolves this vulnerability.Fixed in 4.14.2
Event History
Frequently Asked Questions
Which applications are exposed to a privilege boundary failure?
Applications on POSIX that use AnyIO's run_process() or open_process() to launch child processes with reduced supplementary-group privileges are exposed if they rely on extra_groups to clear or set those groups. The issue is specifically demonstrated on Linux.
Does this affect subprocess launches that do not use extra_groups?
The described faulty forwarding occurs when extra_groups is not None. Calls that do not supply extra_groups are not described as affected by this particular bug.
What happens if group and extra_groups are supplied together?
AnyIO passes the group value, an integer, as extra_groups to the backend. The subprocess call then fails with a TypeError rather than applying the requested supplementary-group configuration.
How can an affected deployment be identified or mitigated before an update is available?
Test the application’s privilege-dropping subprocess path with extra_groups=[] and verify that the child has no inherited supplementary groups. The provided comparison indicates that Python's subprocess.run(..., extra_groups=[]) clears synthetic parent supplementary groups, while AnyIO's run_process(..., extra_groups=[]) preserves them in the demonstrated Linux container.