CVE-2024-40647

sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.

• CWE-200

• https://docs.python.org/3/library/subprocess.html
• https://docs.sentry.io/platforms/python/integrations/default-integrations
• https://docs.sentry.io/platforms/python/integrations/default-integrations/#stdlib
• https://github.com/getsentry/sentry-python/commit/763e40aa4cb57ecced467f48f78f335c87e9bdff
• https://github.com/getsentry/sentry-python/pull/3251
• https://github.com/getsentry/sentry-python/releases/tag/2.8.0
• https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2
• https://docs.python.org/3/library/subprocess.html
• https://docs.sentry.io/platforms/python/integrations/default-integrations
• https://docs.sentry.io/platforms/python/integrations/default-integrations/#stdlib
• https://github.com/getsentry/sentry-python/commit/763e40aa4cb57ecced467f48f78f335c87e9bdff
• https://github.com/getsentry/sentry-python/pull/3251
• https://github.com/getsentry/sentry-python/releases/tag/2.8.0
• https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2
• https://lists.debian.org/debian-lts-announce/2026/06/msg00001.html

Published

Jul 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40641Nuclei is a fast and customizable vulnerability scanner base…7.4
• CVE-2024-40642The netty incubator codec.bhttp is a java language binary ht…8.1
• CVE-2024-40643Joplin is a free, open source note taking and to-do applicat…9.6
• CVE-2024-40644gitoxide An idiomatic, lean, fast & safe pure Rust implement…6.8
• CVE-2024-40645FOG is a cloning/imaging/rescue suite/inventory management s…8.8
• CVE-2024-40646Vertex is a management tool for PT (Private Tracker) users t…8.6
• CVE-2024-40648matrix-rust-sdk is an implementation of a Matrix client-serv…5.4
• CVE-2024-40649In TBD of TBD, there is a possible use-after-free due to a l…8.4
• CVE-2024-4065A vulnerability was found in Tenda AC8 16.03.34.09. It has b…8.8
• CVE-2024-40650In wifi_item_edit_content of styles.xml , there is a possibl…7.8
• CVE-2024-40651In TBD of TBD, there is a possible use-after-free due to a l…8.4
• CVE-2024-40652In onCreate of SettingsHomepageActivity.java, there is a pos…7.8