pypi ipython vulnerabilities

Latest pypi ipython CVEs

Newest publication first

1. CVE-2023-24816 set_term_title command injection in ipython

   Published 2023-02-10

   Medium·CVSS 4.5 EPSS 1.3%

   IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This v...

2. CVE-2015-4706 Improper Neutralization of Input During Web Page Generation in IPython

   Published 2017-09-21

   Medium·CVSS 6.1

   Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.

3. CVE-2015-4707 Improper Neutralization of Input During Web Page Generation in IPython

   Published 2017-09-20

   Medium·CVSS 6.1

   Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.

4. CVE-2015-5607 IPython vulnerable to cross site request forgery (CSRF)

   Published 2017-09-20

   High·CVSS 8.8

   Cross-site request forgery in the REST API in IPython 2 and 3.

5. CVE-2015-7337 Improper Input Validation in Jupyter Notebook

   Published 2015-09-29

   Medium·CVSS 6.8

   The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.

6. CVE-2015-6938 Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

   Published 2015-09-21

   Medium·CVSS 4.3 EPSS 2.8%

   Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as...

7. CVE-2014-3429 IPython Notebook vulnerable to improper validation of the origin of websocket requests

   Published 2014-08-07

   Medium·CVSS 6.8

   IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

8. CVE-2022-21699 Execution with Unnecessary Privileges in ipython

   High·CVSS 8.5

   We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another. Proof of concept User1: mkdir -m 777 /tmp/profile_default mkdir -m 777 /tmp/profile_defa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.