-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sentry-sdk | pip | < 2.8.0 | 2.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is described as the Sentry Python SDK unintentionally exposing environment variables to subprocesses when env={} is used in subprocess calls, if the Stdlib integration is enabled. The provided patch (commit 763e40aa4cb57ecced467f48f78f335c87e9bdff) modifies the sentry_patched_popen_init function within sentry_sdk/integrations/stdlib.py. This function is responsible for patching subprocess.Popen.__init__. The specific change from lambda x: dict(x or os.environ) to lambda x: dict(x if x is not None else os.environ) directly addresses the bug. The old logic (x or os.environ) would cause an empty env={} (which is falsy) to be replaced by os.environ, thus leaking all environment variables. The sentry_patched_popen_init function is therefore the direct location of the vulnerable code logic.
KEV Misses 88% of Exploited CVEs- Get the report