Skip to content

Exclude host PYTHONPATH from venv subprocesses - #11084

Open
0xacee wants to merge 1 commit into
python-poetry:mainfrom
0xacee:fix-run-pythonpath-leak
Open

0xacee wants to merge 1 commit into
python-poetry:mainfrom
0xacee:fix-run-pythonpath-leak

Conversation

@0xacee

@0xacee 0xacee commented Sep 22, 2026

Copy link
Copy Markdown

poetry run and env.execute on a virtualenv-backed environment copy the host environment for the child process. get_temp_environ strips PYTHONHOME and __PYVENV_LAUNCHER__, but not PYTHONPATH, so a PYTHONPATH exported in the host shell leaks into the isolated interpreter:

$ PYTHONPATH=/tmp/evil poetry run python -c 'import os; print(os.getenv("PYTHONPATH"))'
/tmp/evil

A venv is expected to resolve packages itself, and the same leak was treated as a bug in pdm (pdm-project/pdm#3742). Strip PYTHONPATH alongside the other PYTHON* vars.

Adds a regression test that runs a real script in a tmp venv with PYTHONPATH set in the host env; fails on main.

poetry run / env.execute copy the host environment for children of a
virtualenv-backed env, stripping PYTHONHOME but not PYTHONPATH, so a
host PYTHONPATH leaks into the isolated interpreter (same defect as
pdm-project/pdm#3742). The venv should resolve packages itself.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.


Sourcery is free for open source - if you like our reviews please consider sharing them ✨

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant