CVE-2015-5607: IPython Cross-Site Request Forgery (CSRF)

ipython Updated 02 Oct 2025

Summary

17/05/2022

Disclosed on

CVE-2015-5607

CVE

Yes i

Fix available

High

Severity

8.8

CVSS Score

CVE-2015-5607: IPython vulnerable to cross site request forgery (CSRF). Affects ipython across 2 version ranges.

>= 0.12, < 2.4.1 >= 3.0.0, < 3.2.3

Fixed in 2.4.1 or 3.2.3, depending on the release line you run. How to fix ↓

Also tracked for

ipython · Debian:11

The same CVE-2015-5607 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

IPython (Interactive Python) is a command shell that provides an enhanced interactive environment for Python programming. It allows users to execute Python code, access help documentation, and perform various data analysis tasks. The vulnerability in question is related to cross-site request forgery (CSRF) in the REST API of IPython versions 2 and 3. This vulnerability could potentially allow an attacker to trick authenticated users into performing unintended actions on their behalf.

Vulnerability Detail

The CSRF vulnerability in IPython versions 2 and 3 arises due to insufficient protection against forged requests. An attacker can craft a malicious website or email containing a specially crafted request that, when executed by an authenticated IPython user, can perform actions on their behalf without their knowledge or consent. This could lead to unauthorized data access, modification, or other malicious activities. The vulnerability has been assigned a CVSSv3 score of 8.8, indicating a high severity level.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 0.12, < 2.4.1 2.4.1
```
pip install --upgrade "ipython==2.4.1"
```
>= 3.0.0, < 3.2.3 3.2.3
```
pip install --upgrade "ipython==3.2.3"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a workaround, users can disable the IPython REST API or restrict access to trusted IP addresses only. This can be achieved by modifying the IPython configuration file and configuring the appropriate settings. Here is an example of how to disable the REST API in IPython:

Locate the IPython configuration file (typically located at ~/.ipython/profile_default/ipython_config.py).
Open the configuration file in a text editor.
Find the line that starts with 'c.NotebookApp.allow_origin'.
Uncomment the line by removing the '#' character at the beginning.
Change the value to an empty string or a trusted IP address.
Save the configuration file and restart IPython for the changes to take effect.

Please note that this workaround may limit certain functionalities that rely on the REST API.

Conclusion

In conclusion, the IPython versions 2 and 3 are vulnerable to a cross-site request forgery (CSRF) vulnerability in the REST API. This vulnerability can be mitigated by upgrading to the patched versions (2.4.1 or later for version 2, and 3.2.3 or later for version 3) or by implementing the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for ipython →

FAQ

What is IPython?

IPython is an interactive command shell for Python that provides an enhanced environment for Python programming, data analysis, and documentation access.

What is cross-site request forgery (CSRF)?

Cross-site request forgery (CSRF) is a type of attack where an attacker tricks an authenticated user into performing unintended actions on a web application without their knowledge or consent.

Which versions of IPython are affected by this vulnerability?

IPython versions 2 and 3 are affected by this CSRF vulnerability. Specifically, versions up to 2.4.1 and versions up to 3.2.3 are vulnerable.

What are the potential consequences of this vulnerability?

This vulnerability could allow an attacker to perform unauthorized actions on behalf of authenticated IPython users. This could lead to unauthorized data access, modification, or other malicious activities.

How can I mitigate this vulnerability?

To mitigate this vulnerability, it is recommended to upgrade to the patched versions of IPython (2.4.1 or later for version 2, and 3.2.3 or later for version 3). Additionally, you can consider disabling the IPython REST API or restricting access to trusted IP addresses.