theshitの不適切な権限降下により、コマンド再実行によるローカル権限昇格が可能

The vulnerability stems from the application's behavior of automatically re-executing previously failed commands without properly restoring the original user context. When theshit is run with elevated privileges (e.g., using sudo), it records the last executed command and attempts to rerun it. However, the application fails to drop these elevated privileges before re-executing, resulting in the command being executed with root access. This can allow an attacker to gain persistent root access to the system, potentially leading to complete compromise. The impact is significant, as it enables arbitrary code execution with the highest privileges, bypassing standard security controls.

Systems where theshit is deployed and executed with elevated privileges (e.g., using sudo) are at significant risk. This includes development environments, automated build systems, and production servers where theshit is used for administrative tasks. Users who have configured theshit to run with root privileges are particularly vulnerable.

• rust / server:

ps aux | grep theshit

• rust / supply-chain:

find / -name 'theshit' -type f -print

• generic web:

curl -I http://localhost/theshit

1. 2026-03-02Disclosure

   disclosure

1. 予約済み2026-01-05
2. 公開日2026-03-02
3. 更新日2026-03-04
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-21882 is to upgrade to version 0.2.0 or later, which addresses the improper privilege handling. If upgrading immediately is not feasible, consider restricting the use of sudo with theshit to only trusted users and processes. Implement strict input validation and sanitization for any commands passed to theshit to prevent malicious code injection. Monitor system logs for suspicious activity related to theshit, particularly commands executed with elevated privileges. After upgrading, confirm the fix by attempting to re-execute a previously failed command with sudo and verifying that the command is no longer executed with root privileges.