As a rule of thumb, never trust user input, even if you're confident it'll only come from authenticated users. If any of your CGI scripts are internet-facing (i.e. can be executed as a direct consequence of your users requests, be them the jQuery ajax calls or regular page access), you should sanitize all input fields and check proper authentication and authorization before performing any sensitive action.
If your webserver is configured to automatically run scripts in the
cgi-bin folder in response to a matching URL address, then all scripts inside that folder are susceptible from being called by users, in ways that you can not predict or control. If you have scripts that must not be called this way, then you should either store them somewhere else or configure your webserver not to execute them automatically (for instance, whitelisting the URLs that will directly match server resources).
(If in doubt whether a particular script is or is not exposed, just replace it with an innocuous one and try calling it via corresponding URL)
For those reasons, to be really safe you should always perform a full validation of the request before executing it: use a CSRF token, authenticate the user making the request (using a secure session cookie for instance - but .htaccess auth should also work), check the user authorization both to perform that action and to use the provided parameters, and check all parameters for the correct types/syntax and valid values. That may sound a lot of work, but once you get used to these practices it quickly becomes second-nature (and since you're using Python, an additional tip: look for decorators if you don't know them alreay, it'll make a lot easier the task of applying many of the above measures across different functions/scripts).