GHSA-3w57-8xmc-8v26: Pip/anyio vulnerability
AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess() and anyio.openprocess(), but openprocess() forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs["extragroups"] = group instead of extragroups. As a result, callers cannot reliably clear or set supplementary groups for child processes. In a disposable Linux container, Python's subprocess.run(..., extragroups=[]) clears a synthetic parent supplementary group list, while anyio.runprocess(..., extragroups=[]) preserves the parent groups. If group is also supplied, AnyIO passes an integer as extragroups and the call fails with TypeError. This is a POSIX privilege-dropping correctness issue for applications that rely on AnyIO subprocess helpers to launch less-privileged child processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/anyioto a version that resolves this vulnerability.Fixed in 4.14.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using AnyIO 4.14.0 on POSIX systems are exposed if they rely on anyio.run_process() or anyio.open_process() with extra_groups to clear or set supplementary groups for a child process. The practical impact is on privilege-dropping subprocess workflows.
What conditions are needed for the issue to affect a child process?
The caller must pass a non-None extra_groups value to an AnyIO subprocess helper. Passing extra_groups=[] may leave the child process with the parent’s supplementary groups instead of clearing them.
What happens if both group and extra_groups are supplied?
AnyIO forwards the group integer as extra_groups, causing the subprocess call to fail with TypeError. This can prevent the intended child process from being launched.
How can I determine whether my deployment is affected?
Review calls to anyio.run_process() and anyio.open_process() for extra_groups usage on POSIX systems. Affected behavior can be observed by launching a child with extra_groups=[] from a parent that has supplementary groups and checking whether those groups remain in the child.