CVE-2026-21882: Privilege Escalation in theshit

The vulnerability stems from the application's behavior of automatically re-executing previously failed commands without properly restoring the original user context. When theshit is run with elevated privileges (e.g., using sudo), it records the last executed command and attempts to rerun it. However, the application fails to drop these elevated privileges before re-executing, resulting in the command being executed with root access. This can allow an attacker to gain persistent root access to the system, potentially leading to complete compromise. The impact is significant, as it enables arbitrary code execution with the highest privileges, bypassing standard security controls.

1. Reserved2026-01-05
2. Published2026-03-02
3. Modified2026-03-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-21882 is to upgrade to version 0.2.0 or later, which addresses the improper privilege handling. If upgrading immediately is not feasible, consider restricting the use of sudo with theshit to only trusted users and processes. Implement strict input validation and sanitization for any commands passed to theshit to prevent malicious code injection. Monitor system logs for suspicious activity related to theshit, particularly commands executed with elevated privileges. After upgrading, confirm the fix by attempting to re-execute a previously failed command with sudo and verifying that the command is no longer executed with root privileges.