CVE-2022-21699: Arbitrary Code Execution in IPython
Summary
CVE-2022-21699: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affects ipython across 5 version ranges.
>= 6.0.0, < 7.16.3
< 6.0.0rc1
>= 7.17.0, < 7.31.1
>= 8.0.0, < 8.0.1
< 46a51ed69cdf41b4333943d9ceeb945c4ede5668
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- ipython · Debian:11
The same CVE-2022-21699 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, primarily developed for the Python programming language. It provides an enhanced interactive environment with features such as code execution, history logging, and rich media integration. IPython is widely used by developers and data scientists for exploratory programming and data analysis tasks. However, certain versions of IPython are vulnerable to an arbitrary code execution vulnerability.
Vulnerability Detail
The vulnerability in IPython is due to improper management of cross-user temporary files. This flaw allows an attacker to execute arbitrary code as another user on the same machine. By exploiting this vulnerability, an unauthorized user can gain unauthorized access and perform malicious activities, potentially leading to data theft, privilege escalation, or system compromise. The vulnerability affects specific versions of IPython and poses a significant security risk to systems running these versions.
How To Fix
Latest published version: 9.17.1 as of 23 Oct 2026
pip install --upgrade "ipython==9.17.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.0.0rc16.0.0rc1pip install --upgrade "ipython==6.0.0rc1" -
>= 6.0.0, < 7.16.37.16.3pip install --upgrade "ipython==7.16.3" -
>= 7.17.0, < 7.31.17.31.1pip install --upgrade "ipython==7.31.1" -
>= 8.0.0, < 8.0.18.0.1pip install --upgrade "ipython==8.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to IPython by limiting user privileges and enforcing proper file permissions. Additionally, it is recommended to monitor system logs for any suspicious activities and apply relevant security patches and updates as they become available. Implementing these measures can help mitigate the risk of exploitation until the IPython upgrade can be performed.
Conclusion
The vulnerability in IPython allows for arbitrary code execution, posing a significant security risk to systems running affected versions. To mitigate this risk, it is crucial to upgrade IPython to a non-vulnerable version and implement additional security measures. Regularly monitoring for security updates and applying them promptly is essential to maintain a secure environment. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for ipython →
FAQ
IPython is a command shell for interactive computing in multiple programming languages, primarily used with Python. It provides an enhanced interactive environment with features such as code execution, history logging, and rich media integration.
The vulnerability allows an attacker to execute arbitrary code as another user on the same machine. This can lead to unauthorized access, data theft, privilege escalation, or system compromise.
The vulnerability affects versions of IPython up to and including 8.0.0. Versions 6.0.0rc1, 7.16.3, 7.31.1, and 8.0.1 have been identified as fixed.
To fix this vulnerability, it is recommended to upgrade IPython to a non-vulnerable version, such as 6.0.0rc1, 7.16.3, 7.31.1, or 8.0.1. Users should update their IPython installation using package managers like pip.
As a temporary workaround, users can restrict access to IPython by limiting user privileges and enforcing proper file permissions. Monitoring system logs for suspicious activities and applying security patches can also help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for ipython.
