CWE-214: Invocation of Process Using Visible Sensitive Information

A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Many operating systems allow a user to list information about processes that are owned by other users. Other users could see information such as command line arguments or environment variable settings. When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.

Consequences

• Confidentiality: Read Application Data

Recent advisories

• PYSEC-2026-3958 — In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command…
• GHSA-94p4-4cq8-9g67 — GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
• GHSA-pj2r-f9mw-vrcq — PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution
• GHSA-j9pv-rrcj-6pfx — OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes
• GHSA-h3m5-p59h-x88p — openssl-encrypt has visible password in process list via --password CLI argument
• GHSA-x6g4-f6q3-fqvv — NATS credentials are exposed in monitoring port via command-line argv
• GHSA-339q-62wm-c39w — Undertow vulnerable to Denial of Service (DoS) attacks

All advisories for CWE-214