GHSA-g92j-qhmh-64v2 Sentry's Python SDK unintentionally exposes environment variables to subprocesses

• PyPI sentry-sdk: >= 2.0.0a1, < 2.8.0 → fixed in 2.8.0 • PyPI sentry-sdk: < 1.45.1 → fixed in 1.45.1

Impact The bug in Sentry's Python SDK >> subprocess.check_output(["env"], env={"TEST":"1"}) b'TEST=1\n' ``` If you'd want to not pass any variables, you can set an empty dict: ``` >>> subprocess.check_output(["env"], env={}) b'' ``` However, the bug in Sentry SDK <2.8.0 causes all environment variables to be passed to the subprocesses when `env={}` is set, unless the Sentry SDK's Stdlib integration is disabled. The Stdlib integration is enabled by default. Patches The issue has been patched in https://github.com/getsentry/sentry-python/pull/3251 and the fix released in sentry-sdk==2.8.0. The fix was also backported to sentry-sdk==1.45.1. Workarounds We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, there are two options: 1. In your application, replace `env={}` with the minimal dict `env={"EMPTY_ENV":"1"}` or similar. OR 2. Disable Stdlib integration: ``` import sentry_sdk Should go before sentry_sdk.init sentry_sdk.integrations._DEFAULT_INTEGRATIONS.remove("sentry_sdk.integrations.stdlib.StdlibIntegration") sentry_sdk.init(...) ``` References • Sentry docs: Default integrations • Python docs: subprocess module • Patch https://github.com/getsentry/sentry-python/pull/3251