Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-21882 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-2 (Account Management) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-21882 affects theshit, a command-line utility designed to automatically detect and fix common mistakes in shell commands. In versions prior to 0.2.0, the vulnerability stems from improper privilege dropping, which enables local privilege escalation through command re-execution. This flaw is associated with CWEs 250 (Execution with Unnecessary Privileges), 269 (Improper Privilege Management), and 273 (Improper Check for Dropped Privileges), and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete confidentiality, integrity, and availability impacts.
A local attacker requires only local access to the system with no special privileges (PR:N) and can exploit the issue with low complexity and no user interaction. By leveraging the improper privilege dropping during command re-execution, the attacker can escalate from an unprivileged account to higher privileges, potentially gaining full control over the system and executing arbitrary code with elevated rights.
The vulnerability has been addressed in theshit version 0.2.0, as detailed in the project's GitHub security advisory (GHSA-2j3p-gqw5-g59j) and the patching commit (5293957b119e55212dce2c6dcbaf1d7eb794602a). Security practitioners should recommend immediate upgrades to the patched version for affected installations to mitigate the risk of local privilege escalation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9256
Vulnerability Data
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 6 OS baselines
V10.2.3V13.2.2
Mitigating Controls (NIST 800-53 r5) AI
Account management directly governs assignment and tracking of privileges so proper implementation stops the weakness from being introduced.
Requiring explicit access-control decisions ensures privileges are evaluated rather than assumed or omitted.
Access enforcement applies the correct privilege checks at every request, structurally preventing unintended spheres of control.
Separation of duties constrains how privileges may be assigned, reducing the chance of overly broad actor control.
Least privilege directly requires that only the minimum necessary authorizations are granted, structurally eliminating execution with unnecessary privileges.
Binding security attributes to subjects/objects supplies the mechanism needed to track and enforce privileges correctly.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-05 directly enforces least privilege so largely eliminates CWE-250 at design time, yet the weakness can still arise from runtime escalation paths, third-party code, or misapplied role definitions outside this single control.
Secure SDLC activities (code review, static analysis, testing) catch missing or incorrect privilege-drop checks, but eliminating only this one flaw covers only a fraction of the control's broader intent.
PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.
Config baselines and default reviews can enforce some privilege-related settings (one facet) but do not address code-level assignment/tracking logic that defines CWE-269.
PR.PS-05 can partially limit exploitability of some privilege issues via execution restrictions, but does not address the core design/implementation flaws of CWE-269 at all.
PR.DS-10 protects data-in-use without touching privilege assignment/tracking, so it neither prevents CWE-269 nor removes more than one narrow facet of its risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.
Restricting privileged utilities to the fewest trusted users and requiring explicit authorization directly stops developers or operators from embedding or invoking code that runs with unnecessary elevated rights.
Mandating separate non-privileged identities for routine work and restricting privileged accounts to administrative tasks reduces the chance that everyday operations run with unnecessary elevated rights.
Security testing can detect failed privilege drops, yet the control does not require such checks as part of its core intent.
Dynamic techniques that grant the minimum necessary rights for a given time window and revoke them afterward reduce the window in which excessive or unnecessary privileges can be exploited.
The control explicitly calls for minimizing privileged identities and disabling unnecessary accounts, thereby reducing the number of processes that run with unnecessary privileges.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-250, CWE-269
Windows 11 (1 rule)
- V-253269 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-250, CWE-269
Windows Server 2016 (1 rule)
- V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. prevents CWE-250, CWE-269
Windows Server 2019 (1 rule)
- V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-250, CWE-269
Windows Server 2022 (1 rule)
- V-254428 Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-250, CWE-269