CVE-2023-24816: IPython Command Injection Vulnerability
Summary
CVE-2023-24816: IPython vulnerable to command injection via set_term_title. Affects ipython versions < 8.10.0. Fixed in 8.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython is an interactive Python shell and Jupyter kernel that allows users to work with Python interactively. It provides a rich set of features and functionalities for Python developers and data scientists. However, versions prior to 8.10.0 are vulnerable to a command injection vulnerability in the set_term_title function under specific conditions.
Vulnerability Detail
The set_term_title function in IPython is susceptible to command injection when called in a Windows environment without the availability of the ctypes library. Although the vulnerable code is effectively dead code due to the dependency on ctypes, it could introduce a vulnerability for dependencies. The function is currently only called with semi-trusted input, which includes the current working directory of the IPython session. If an attacker can control directory names and trick a user into changing to that directory, they can execute arbitrary commands contained in the folder names.
How To Fix
Latest published version: 9.17.1 as of 23 Oct 2026
pip install --upgrade "ipython==9.17.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.10.0
This is the first release that contains the fix.
pip install --upgrade "ipython==8.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to update to the patched version of IPython as soon as possible.
Conclusion
The command injection vulnerability in IPython's set_term_title function can be mitigated by updating to version 8.10.0 or later. It is crucial to promptly apply the patch to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ipython →
FAQ
IPython is an interactive Python shell and Jupyter kernel that provides a powerful environment for Python developers and data scientists to work with Python interactively.
Versions prior to 8.10.0 are vulnerable to this command injection vulnerability.
This vulnerability is only exploitable in a Windows environment where the ctypes library is not available.
If successfully exploited, an attacker can execute arbitrary commands on the system by manipulating directory names and tricking a user into changing to a malicious directory.
No, there is no specific workaround available. It is recommended to update to the patched version of IPython.
References
Related vulnerabilities
Recent vulnerabilities recorded for ipython.
