{"action":"Upgrade sentry-sdk to 1.45.1 or later.","affected":[{"fixed":"1.45.1","introduced":"0"},{"fixed":"2.8.0","introduced":"2.0.0a1"}],"component":"sentry-sdk","cve_ids":["CVE-2024-40647"],"ecosystem":"PyPI","epss":0.002,"exploited":false,"fixed_versions":["1.45.1","2.8.0"],"ghsa_id":"GHSA-g92j-qhmh-64v2","id":"tcs_01M5KGWENPH8ZY6CGTNG4GNGJ7","modified_at":"2026-07-07T17:47:52.959930142Z","published_at":"2026-07-07T14:34:36.976776Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1917","https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2","https://nvd.nist.gov/vuln/detail/CVE-2024-40647","https://github.com/getsentry/sentry-python/pull/3251","https://github.com/getsentry/sentry-python/commit/763e40aa4cb57ecced467f48f78f335c87e9bdff","https://docs.python.org/3/library/subprocess.html","https://docs.sentry.io/platforms/python/integrations/default-integrations","https://docs.sentry.io/platforms/python/integrations/default-integrations/#stdlib","https://github.com/getsentry/sentry-python","https://github.com/getsentry/sentry-python/releases/tag/1.45.1","https://github.com/getsentry/sentry-python/releases/tag/2.8.0","https://lists.debian.org/debian-lts-announce/2026/06/msg00001.html","https://pypi.org/project/sentry-sdk","https://github.com/advisories/GHSA-g92j-qhmh-64v2"],"severity":{"label":"low","score":2.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1917","url":"https://osv.dev/vulnerability/PYSEC-2026-1917"}],"summary":"Sentry's Python SDK unintentionally exposes environment variables to subprocesses"}