The Python documentation makes it clear that having shell=True in your call to subprocess.check_output (and other functions) is a potential security risk. If you're getting input from an unknown or ...

There might be some gross way to follow the link and figure out where it actually is--maybe try to execute "readlink /usr/bin/python" from within the CGI script, using subprocess?