Is ipython safe ? 8 known vulnerabilities, worst severity CRITICAL.
// reach 36 direct dependencies
7 carry known advisories, worst CRITICAL
390 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 85th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-92mr-v722-f48m, the advisory selected below
// 8 advisories GHSA-92mr-v722-f48m The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types. CRIT GHSA-7fc2-rm35-2pp7 IPython (Interactive Python) is a command shell. Cross-site request forgery in the REST API is possible in in IPython 2 and 3. Versions 2.4.1 and 3.2.3 contain patches. HIGH GHSA-75cw-5cgv-g853 IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. HIGH GHSA-pq7m-3gw7-gq5x We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another. HIGH GHSA-q326-jhw3-699g Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path. MODE GHSA-4vwq-x64q-j4cj Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate. MODE GHSA-66gw-5xpf-gfp5 Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path. MODE GHSA-29gw-9793-fvw7 IPython provides an interactive Python shell and Jupyter kernel to use Python interactively. Versions prior to 8.10.0 are vulnerable to command injection in the set_term_title function under specific conditions. This has been patched in version 8.10.0. LOW The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High Checked 2026-11-07 at 17:05 UTC. The most recent advisory here was published 2023-02-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page