{"id":"PSF-2017-8","aliases":[],"status":"published","title":"Environment variables injection in subprocess on Windows","description":"On Windows, prevent passing invalid environment variables and command\narguments to subprocess.Popen.\n\nIt is possible to inject an environment variable in subprocess on Windows\nif a user data is passed to a subprocess via environment variable.\n\nCheck for invalid environment (variable names containing '=') and command\narguments (containing '\\0').","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2017-06-22T00:00:00Z","modified":"2025-10-09T00:59:49Z","references":[{"url":"https://bugs.python.org/issue30730","tags":["report"]}],"sources":{"osv":[{"id":"PSF-2017-8","title":"Environment variables injection in subprocess on Windows","description":"On Windows, prevent passing invalid environment variables and command\narguments to subprocess.Popen.\n\nIt is possible to inject an environment variable in subprocess on Windows\nif a user data is passed to a subprocess via environment variable.\n\nCheck for invalid environment (variable names containing '=') and command\narguments (containing '\\0').\n","status":"published","published":"2017-06-22T00:00:00Z","modified":"2025-10-09T00:59:49.228511Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}