AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio
    or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and
    anyio.open_process(), but open_process() forwards the group argument to the backend instead of
    extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore
    launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group
    is also supplied, the integer group value is passed where an iterable of supplementary groups is expected
    and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO
    subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.
    (CVE-2026-63349)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio     or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and     anyio.open_process(), but open_process() forwards the group argument to the backend instead of     extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore     launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group     is also supplied, the integer group value is passed where an iterable of supplementary groups is expected     and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO     subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.
    (CVE-2026-63349)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462760	Echo: anyio: security update to 4.14.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
462760	Echo: anyio: security update to 4.14.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
348555	Linux Distros Unpatched Vulnerability : CVE-2026-63349	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-63349

high

Tenable Plugins

high

high

high