This is Not a vulnerability. It is expected behavior. If someone can Set Environment variables or write to /etc/ it is already game over