CVE-2015-4707: Cross-Site Scripting (XSS) Vulnerability in IPython
Summary
CVE-2015-4707: Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path. Affects ipython across 3 version ranges.
< 3.2.0
< 7222bd53ad089a65fd610fab4626f9d0ab47dfce
< c2078a53543ed502efd968649fee1125e0eb549c
Fixed in c2078a53543ed502efd968649fee1125e0eb549c. How to fix ↓
Also tracked for
- ipython · Debian:11
The same CVE-2015-4707 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython is an interactive command-line interface for Python that provides enhanced features for code execution, debugging, and data visualization. It is widely used by developers and data scientists for interactive computing and exploratory analysis. The vulnerability in IPython before version 3.2 allows remote attackers to inject arbitrary web script or HTML through JSON error messages and the /api/notebooks path.
Vulnerability Detail
The vulnerability in IPython is a cross-site scripting (XSS) vulnerability. It occurs when user-supplied input is not properly sanitized and is rendered as HTML or JavaScript on the client-side. In this case, the vulnerability arises from JSON error messages and the /api/notebooks path. An attacker can exploit this vulnerability by injecting malicious code or scripts, which will be executed within the context of the user's browser. This can lead to various attacks, such as session hijacking, defacement of web pages, or theft of sensitive information.
How To Fix
Latest published version: 9.17.1 as of 23 Oct 2026
pip install --upgrade "ipython==9.17.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c2078a53543ed502efd968649fee1125e0eb549c
This is the first release that contains the fix.
pip install --upgrade "ipython==c2078a53543ed502efd968649fee1125e0eb549c"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the /api/notebooks path or implement input validation and sanitization manually. Here is an example of how to disable the /api/notebooks path in IPython configuration:
# Disable the /api/notebooks path
c.NotebookApp.allow_origin = ''
However, it is strongly recommended to upgrade to the latest version as soon as possible.
Conclusion
The cross-site scripting (XSS) vulnerability in IPython before version 3.2 allows remote attackers to inject arbitrary web script or HTML, potentially leading to various attacks. It is crucial to upgrade to the latest version of IPython (3.2.0 or later) to fix this vulnerability. In the meantime, disabling the /api/notebooks path or implementing input validation and sanitization can serve as temporary workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ipython →
FAQ
This vulnerability allows remote attackers to inject malicious code or scripts into IPython, potentially leading to various attacks such as session hijacking, defacement of web pages, or theft of sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your IPython installation is affected by this vulnerability. Simply enter your Pipfile.lock and it will provide real-time alerts for open-source vulnerabilities.
Yes, the vulnerability can be fixed by upgrading to IPython version 3.2.0 or later. It is important to keep your software up to date to ensure the security of your application.
A temporary workaround is to disable the /api/notebooks path or implement input validation and sanitization manually. However, it is strongly recommended to upgrade to the latest version as soon as possible.
You can find more information about this vulnerability in the IPython advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/ipython/PYSEC-2017-46.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for ipython.
