gh-101283: Try to load the fallback cmd.exe by an absolute path

Lib/subprocess.py

@@ -1480,7 +1480,16 @@ def _execute_child(self, args, executable, preexec_fn, close_fds,
             if shell:
                 startupinfo.dwFlags |= _winapi.STARTF_USESHOWWINDOW
                 startupinfo.wShowWindow = _winapi.SW_HIDE
-                comspec = os.environ.get("COMSPEC", "cmd.exe")
+                # gh-101283: with no full path, Windows looks into a
+                # current directory first so no plain "cmd.exe".
+                default_shell = "C:\\WINDOWS\\system32\\cmd.exe"
+                comspec = os.environ.get("COMSPEC", default_shell)
+                if not os.path.isfile(comspec):
+                    # Windows is installed into a non-standard location
+                    # or the system environment variable is broken.
+                    # It's highly unlikely and we cannot help here.
+                    comspec = "cmd.exe"
+
                 args = '{} /c "{}"'.format (comspec, args)
 
             if cwd is not None:

Misc/NEWS.d/next/Security/2023-01-24-16-12-00.gh-issue-101283.9tqu39.rst

@@ -0,0 +1,3 @@
+:meth:`subprocess.Popen.__init__` no-``COMSPEC`` fallback now looks for an
+absolute path ``C:\\WINDOWS\\system32\\cmd.exe`` before falling back further
+to an old ``cmd.exe``. Patch by Oleg Iarygin.