IPython is a widely used interactive computing environment and Jupyter notebook kernel that sits in data-science and development workflows, often exposed in multi-user or internet-facing contexts. Its vulnerability profile centers on the core IPython and Notebook products and clusters around input-handling and code-generation weaknesses, including cross-site scripting, input validation gaps, cross-site request forgery, and code injection, reflecting the dual challenge of executing user-supplied code safely while rendering untrusted content in notebook interfaces. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ipython over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-21699HIGH IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected vers | Jan 19, 2022 | 8.8 | 29 | NO | NO |
CVE-2015-5607HIGH Cross-site request forgery in the REST API in IPython 2 and 3. | Sep 20, 2017 | 8.8 | 27 | NO | NO |
CVE-2023-24816HIGH IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prio | Feb 10, 2023 | 7.0 | 24 | NO | NO |
CVE-2014-3429MEDIUM IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of | Aug 7, 2014 | 6.8 | 19 | NO | NO |
CVE-2015-7337MEDIUM The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers | Sep 29, 2015 | 6.8 | 18 | NO | NO |
CVE-2015-4706MEDIUM Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the | Sep 21, 2017 | 6.1 | 17 | NO | NO |
CVE-2015-4707MEDIUM Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api | Sep 20, 2017 | 6.1 | 17 | NO | NO |
CVE-2015-6938MEDIUM Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attac | Sep 21, 2015 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ipython.
Media articles that mention a CVE ID that affects a product developed by Ipython — matched by CVE ID, not by vendor name.