Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-40647 EUVD-2024-2345GHSA-g92j-qhmh-64v2PYSEC-2026-1917

Unintentional exposure of environment variables to subprocesses in sentry-sdk

Published Jul 18, 2024 · Updated Jun 1, 2026 · Assigned by GitHub_M

Description

sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations.

Affected products

VendorProductAffectedFixed
getsentry sentry-python < 2.8.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 sentry-python 2.16.0-1 —
Debian 13 sentry-python 2.16.0-1 —
Debian 12 sentry-python 1.9.10-2+deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 sentry-python No fix yet —
Ubuntu 26.04 LTS sentry-python No fix yet —
Ubuntu 25.10 sentry-python No fix yet —
Ubuntu 24.04 LTS sentry-python No fix yet —
Ubuntu 22.04 LTS sentry-python No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS sentry-python No fix yet —
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP5 python-sentry-sdk 0.14.4-bp155.3.3.1 openSUSE-SU-2024:0214-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-sentry-sdk 2.10.0-1.1 openSUSE-SU-2026:11425-1, openSUSE-SU-2024:14209-1
openSUSE Leap 15.5 python-sentry-sdk 0.14.4-bp155.3.3.1 openSUSE-SU-2024:0214-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI sentry-sdk >= 2.0.0a1, < 2.8.0 2.8.0 GHSA-g92j-qhmh-64v2
PyPI sentry-sdk < 1.45.1 1.45.1 GHSA-g92j-qhmh-64v2
PyPI sentry-sdk < 1.45.1 · >= 2.0.0a1, < 2.8.0 1.45.1, 2.8.0 PYSEC-2026-1917

Advisories 3

References