sympy/sympy — pull request #8146 by immerrr (2014-09-29 17:53:23+00:00)
Title: Don't evaluate arbitrary text coming from SYMPY_DEBUG variable

With all the talks about recent shellshock vulnerability discovery in
Bash I've remembered encountering similar unguarded execution of
arbitrary text coming from the environment in sympy. It is not that
critical, but it may be used to gain root privileges if there's a
script importing sympy with setuid bit on it.

This PR should fix the issue.

I'm not sure where to put tests for it, though, as there's no test
suites in the root directory, maybe into `sympy.core`?