Security

SECURITY.md

Security Policy

Supported Versions

Version	Supported
>= 2.2.5	✅

Reporting a Vulnerability

Please disclose any vulnerabilities to arwmoffat@gmail.com

sh _uid does not drop supplementary groups (incomplete privilege drop)
GHSA-q38v-wp89-2w55 published Jun 5, 2026 by amoffat

High

Learn more about advisories related to amoffat/sh in the GitHub Advisory Database