The sentry-python SDK before version 2.8.0 contains a bug where environment variables are passed to subprocesses even when the subprocess call explicitly sets env={} to prevent this. This behavior is caused by the Stdlib integration enabled by default in the SDK. The unintended passing of environment variables can expose sensitive information to subprocesses that should not receive it. The issue is tracked as CVE-2024-40647 and classified under CWE-200 (Exposure of Sensitive Information). The vulnerability was patched in pull request #3251 and included in sentry-sdk version 2.8.0.

Sensitive environment variables may be exposed to subprocesses spawned by applications using vulnerable versions of sentry-python SDK. This exposure could lead to unauthorized access to sensitive data contained in environment variables. The CVSS score of 5.3 (medium severity) reflects that the attack vector requires local access with high privileges and no user interaction, and the impact is limited to confidentiality without affecting integrity or availability.

A fix is available in sentry-python SDK version 2.8.0. Users should upgrade to version 2.8.0 or later to resolve this vulnerability. If upgrading is not possible, users can mitigate the risk by disabling all default integrations in the SDK to prevent environment variables from being passed to subprocesses. There is no indication that the vulnerability is mitigated by default or that no action is required.