CVE-2026-21882

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21882", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T17:24:36.928Z", "datePublished": "2026-03-02T19:17:22.220Z", "dateUpdated": "2026-03-02T19:44:41.557Z"}, "containers": {"cna": {"title": "theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-273", "lang": "en", "description": "CWE-273: Improper Check for Dropped Privileges", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-250", "lang": "en", "description": "CWE-250: Execution with Unnecessary Privileges", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-2j3p-gqw5-g59j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-2j3p-gqw5-g59j"}, {"name": "https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a", "tags": ["x_refsource_MISC"], "url": "https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a"}], "affected": [{"vendor": "AsfhtgkDavid", "product": "theshit", "versions": [{"version": "< 0.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T19:17:22.220Z"}, "descriptions": [{"lang": "en", "value": "theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0."}], "source": {"advisory": "GHSA-2j3p-gqw5-g59j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T19:44:23.867553Z", "id": "CVE-2026-21882", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:44:41.557Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21882", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T19:44:23.867553Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T19:44:30.750Z"}}], "cna": {"title": "theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution", "source": {"advisory": "GHSA-2j3p-gqw5-g59j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "AsfhtgkDavid", "product": "theshit", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "references": [{"url": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-2j3p-gqw5-g59j", "name": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-2j3p-gqw5-g59j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a", "name": "https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-273", "description": "CWE-273: Improper Check for Dropped Privileges"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250: Execution with Unnecessary Privileges"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-02T19:17:22.220Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21882", "state": "PUBLISHED", "dateUpdated": "2026-03-02T19:44:41.557Z", "dateReserved": "2026-01-05T17:24:36.928Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-02T19:17:22.220Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "theshit", "vendor": "AsfhtgkDavid", "versions": [{"status": "affected", "version": "< 0.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0."}, {"lang": "es", "value": "theshit es una utilidad de l\u00ednea de comandos que detecta y corrige autom\u00e1ticamente errores comunes en comandos de shell. Antes de la versi\u00f3n 0.2.0, una ca\u00edda de privilegios inadecuada permite la escalada de privilegios local mediante la reejecuci\u00f3n de comandos. Este problema ha sido parcheado en la versi\u00f3n 0.2.0."}], "id": "CVE-2026-21882", "lastModified": "2026-06-17T10:19:05.067", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21882", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T19:44:23.867553Z", "version": "2.0.3"}}]}, "published": "2026-03-02T20:16:26.130", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/AsfhtgkDavid/theshit/commit/5293957b119e55212dce2c6dcbaf1d7eb794602a"}, {"source": "security-advisories@github.com", "url": "https://github.com/AsfhtgkDavid/theshit/security/advisories/GHSA-2j3p-gqw5-g59j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}, {"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-273"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "theshit", "source": "cna", "vendor": "AsfhtgkDavid"}, "product": "theshit", "vendor": "asfhtgkdavid"}], "analysis": {"en": {"generated_at": "2026-04-16T14:17:54.017488+00:00", "value": {"mitigation_remediation": ["Upgrade to theshit version 0.2.0 or later, which contains the privilege\u2011dropping fix. ", "If upgrading immediately is not feasible, limit the use of the tool to non\u2011privileged users and restrict the execution of commands that could trigger re\u2011execution. ", "Audit and remove any scripts or workflows that invoke theshit with elevated privileges, ensuring that privilege escalation cannot be achieved through indirect command execution."], "summary": {"action": "Patch Immediately", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the theshit utility developed by AsfhtgkDavid. Any installation running a version earlier than 0.2.0 is susceptible; the problem was resolved in the 0.2.0 release.", "description_and_impact": "The theshit command\u2011line utility contains a flaw where privilege dropping is handled incorrectly. When a user runs the tool with elevated rights, the utility may re\u2011execute commands without properly relinquishing those privileges, enabling an attacker who can exercise local control over the system to gain higher privileges. The weakness is manifested as an improper elevation of privilege and violates the principle of least privilege, as captured by CWE\u2011250, CWE\u2011269 and CWE\u2011273.", "risk_and_exploitability": "The CVSS score of 8.4 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests that public exploitation is unlikely but it remains a plausible threat vector for local attackers. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential for local privilege escalation makes it a high\u2011risk asset for systems that allow users to run the utility with elevated rights. The most straightforward exploitation path involves an attacker who can execute shell commands or scripts on the host and re\u2011invoke the utility under an elevated context, thereby acquiring additional privileges."}}}}, "created": "2026-03-03T08:41:05.451856+00:00", "updated": "2026-04-16T14:30:16.121164+00:00", "vendors": ["asfhtgkdavid", "asfhtgkdavid$PRODUCT$theshit"]}