CVE-2013-4251: Insecure Temporary Directories in scipy
Summary
CVE-2013-4251: The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. Affects scipy across 2 version ranges.
< 0.12.1
< bd296e0336420b840fcd2faabb97084fd252a973
Fixed in bd296e0336420b840fcd2faabb97084fd252a973. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Scipy is a scientific computing library for Python that provides functionality for numerical integration, optimization, signal processing, and more. It is widely used in various scientific and engineering applications. However, prior to version 0.12.1, scipy.weave, a component of SciPy, created insecure temporary directories.
Vulnerability Detail
The vulnerability (CVE-2013-4251) in scipy.weave allowed the creation of insecure temporary directories. This could potentially lead to unauthorized access or manipulation of sensitive data stored in these directories. Attackers could exploit this vulnerability to execute arbitrary code, escalate privileges, or perform other malicious activities.
How To Fix
Latest published version: 1.18.1 as of 23 Oct 2026
pip install --upgrade "scipy==1.18.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
bd296e0336420b840fcd2faabb97084fd252a973
This is the first release that contains the fix.
pip install --upgrade "scipy==bd296e0336420b840fcd2faabb97084fd252a973"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In summary, the vulnerability in scipy.weave allowed the creation of insecure temporary directories, which could lead to unauthorized access or manipulation of sensitive data. It is crucial to upgrade to SciPy version 0.12.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for scipy →
FAQ
The vulnerability could allow attackers to gain unauthorized access to sensitive data or execute arbitrary code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
There are no known public exploits for this vulnerability at the moment.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the fixed version of SciPy.
You can find more information about this vulnerability in the PyPA Advisory Database: https://github.com/pypa/advisory-database/blob/main/vulns/scipy/PYSEC-2019-156.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for scipy.
