CVE-2026-63349: anyio Incorrect Privilege Assignment in run_process / open_process

import asyncio
import anyio
import os

# Simulate a parent process carrying a synthetic supplementary group (e.g. gid 1337).
# On anyio 4.14.0 / 4.14.1, extra_groups=[] is silently ignored:
# the child inherits the parent's full supplementary group list.

async def demonstrate_bypass():
    # Expected: child has NO supplementary groups (empty list passed).
    # Actual on vulnerable versions: child retains parent supplementary groups.
    result = await anyio.run_process(
        ["python3", "-c", "import os; print(os.getgroups())"],
        extra_groups=[],   # should clear supplementary groups -- does NOT
    )
    print("Child groups (should be []):", result.stdout.decode().strip())

    # Extra: combining group= and extra_groups= raises TypeError on vulnerable builds
    # because the backend receives an int where a list is expected.
    try:
        await anyio.run_process(
            ["id"],
            group=1000,
            extra_groups=[],
        )
    except TypeError as e:
        print("TypeError (group int passed as extra_groups):", e)

asyncio.run(demonstrate_bypass())