Hi, I updated my vulnerability table for the Python 3.6.2 release: http://python-security.readthedocs.io/vulnerabilities.html I also added bpo-30730: "Environment variables injection in subprocess on Windows". Sadly, we missed to fix the "urllib FTP protocol stream injection" vulnerability. Victor