VYPR
← All advisories
Medium severity5.3OSV Advisory· Published Jul 18, 2024· Updated Jun 1, 2026

CVE-2024-40647

CVE-2024-40647

Description

Sentry's Python SDK before 2.8.0 leaks environment variables to subprocesses even when env={} is set, due to a bug in the Stdlib integration.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Sentry's Python SDK before 2.8.0 leaks environment variables to subprocesses even when `env={}` is set, due to a bug in the Stdlib integration.

Vulnerability

The bug resides in the sentry_sdk Python SDK versions prior to 2.8.0. When the Stdlib integration (enabled by default) is active, the SDK incorrectly overrides the env argument in subprocess calls, causing all environment variables to be passed to child processes even if the user explicitly sets env={} to prevent that [2]. The Python subprocess module normally passes environment variables by default, but the env argument allows overriding; the SDK's instrumentation breaks this expectation [1].

Exploitation

An attacker does not need special privileges to exploit this; the vulnerability is triggered automatically whenever an application using the vulnerable SDK spawns a subprocess with env={}. The attacker must have some way to observe the subprocess's environment, for example by controlling the subprocess or its output. No user interaction beyond normal application execution is required.

Impact

Successful exploitation leads to unintended disclosure of environment variables to subprocesses. Environment variables often contain sensitive information such as API keys, database credentials, or secrets. This information leakage could compromise the security of the application and its infrastructure.

Mitigation

The issue is patched in sentry-sdk version 2.8.0, released with pull request #3251 [2]. Users should upgrade to 2.8.0 or later. If upgrading is not possible, a workaround is to disable all default integrations by setting default_integrations=False when calling sentry_sdk.init() [3][4]. This will disable the Stdlib integration and prevent the bug.

References
  1. subprocess — Subprocess management
  2. NVD - CVE-2024-40647
  3. Default Integrations | Sentry for Python
  4. Default Integrations | Sentry for Python

AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
sentry-sdkPyPI
>= 2.0.0a1, < 2.8.02.8.0
sentry-sdkPyPI
< 1.45.11.45.1

Affected products

5

Patches

2
763e40aa4cb5

fix(integrations): don't send full env to subprocess (#3251)

https://github.com/getsentry/sentry-pythonIvana KellyerJul 8, 2024via ghsa
commit
2 files changed · +18 −1
  • sentry_sdk/integrations/stdlib.py+5 −1 modified
    @@ -207,7 +207,11 @@ def sentry_patched_popen_init(self, *a, **kw):
             ):
                 if env is None:
                     env = _init_argument(
-                        a, kw, "env", 10, lambda x: dict(x or os.environ)
+                        a,
+                        kw,
+                        "env",
+                        10,
+                        lambda x: dict(x if x is not None else os.environ),
                     )
                 env["SUBPROCESS_" + k.upper().replace("-", "_")] = v
  • tests/integrations/stdlib/test_subprocess.py+13 −0 modified
    @@ -174,6 +174,19 @@ def test_subprocess_basic(
         assert sys.executable + " -c" in subprocess_init_span["description"]
 
 
+def test_subprocess_empty_env(sentry_init, monkeypatch):
+    monkeypatch.setenv("TEST_MARKER", "should_not_be_seen")
+    sentry_init(integrations=[StdlibIntegration()], traces_sample_rate=1.0)
+    with start_transaction(name="foo"):
+        args = [
+            sys.executable,
+            "-c",
+            "import os; print(os.environ.get('TEST_MARKER', None))",
+        ]
+        output = subprocess.check_output(args, env={}, universal_newlines=True)
+    assert "should_not_be_seen" not in output
+
+
 def test_subprocess_invalid_args(sentry_init):
     sentry_init(integrations=[StdlibIntegration()])
6f4685e29b07
https://github.com/getsentry/sentry-pythonvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.