gh-101283: Try to load the fallback cmd.exe by an absolute path

Lib/subprocess.py

@@ -1480,7 +1480,26 @@ def _execute_child(self, args, executable, preexec_fn, close_fds,
             if shell:
                 startupinfo.dwFlags |= _winapi.STARTF_USESHOWWINDOW
                 startupinfo.wShowWindow = _winapi.SW_HIDE
-                comspec = os.environ.get("COMSPEC", "cmd.exe")
+                # gh-101283: without a fully-qualified path, before Windows
+                # checks the system directories, it first looks in the
+                # application directory, and also the current directory if
+                # NeedCurrentDirectoryForExePathW(ExeName) is true, so try
+                # to avoid executing unqualified "cmd.exe".
+                comspec = os.environ.get('ComSpec')
+                if not comspec:
+                    system_drive = os.environ.get('SystemDrive') or 'C:'
+                    system_root = os.environ.get('SystemRoot') or os.path.join(
+                        system_drive, 'Windows')
+                    comspec = os.path.join(system_root, 'System32', 'cmd.exe')
+                    if not os.path.isfile(comspec):
+                        # cmd.exe is missing, or the system environment
+                        # variables are broken, or they're undefined and the
+                        # system is installed into a non-standard location.
+                        # This is highly unlikely, and we cannot help here.
+                        comspec = 'cmd.exe'
+                if not executable and os.path.isabs(comspec):
+                    executable = comspec
+
                 args = '{} /c "{}"'.format (comspec, args)
 
             if cwd is not None:

Misc/NEWS.d/next/Security/2023-01-24-16-12-00.gh-issue-101283.9tqu39.rst

@@ -0,0 +1,6 @@
+Windows version of :meth:`subprocess.Popen.__init__` with
+``shell=True`` made its shell search algorithm protected from dropping
+a program named ``cmd.exe`` into a current directory. Now the current
+directory is used as the last resort if system environment variables
+are totally stripped and Windows is installed not into ``C\Windows``.
+Patch by Eryk Sun.