CVE-2026-21882

Description

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.

PUBLISHED Reserved 2026-01-05 | Published 2026-03-02 | Updated 2026-03-02 | Assigner GitHub_M

Problem types

CWE-273: Improper Check for Dropped Privileges

CWE-269: Improper Privilege Management

CWE-250: Execution with Unnecessary Privileges

Product status

References

github.com/...heshit/security/advisories/GHSA-2j3p-gqw5-g59j

github.com/...ommit/5293957b119e55212dce2c6dcbaf1d7eb794602a

cve.org (CVE-2026-21882)

nvd.nist.gov (CVE-2026-21882)

Download JSON