PSF-2017-8
Environment variables injection in subprocess on Windows
On Windows, prevent passing invalid environment variables and command arguments to subprocess.Popen.
It is possible to inject an environment variable in subprocess on Windows if a user data is passed to a subprocess via environment variable.
Check for invalid environment (variable names containing '=') and command arguments (containing '\0').
What each source reports
OSV No score
Environment variables injection in subprocess on Windows
On Windows, prevent passing invalid environment variables and command arguments to subprocess.Popen.
It is possible to inject an environment variable in subprocess on Windows if a user data is passed to a subprocess via environment variable.
Check for invalid environment (variable names containing '=') and command arguments (containing '\0').
- Record
PSF-2017-8- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
PSF-2017-8 is a vulnerability with no CVSS score yet, published June 22, 2017. No source lists public exploit code. No source names a fixed version.