汇总 ipython 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
已披露问题常与 跨站脚本、输入验证问题与CSRF 相关，可能在 软件部署与生产负载 场景中带来 会话劫持与异常行为 等暴露风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2023-24816 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` pre | [email protected] | 4.5 | 1.29% | 2023-02-10 | 2026-06-17 |
| CVE-2022-21699 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade. | [email protected] | 8.2 | 0.66% | 2022-01-19 | 2026-06-17 |
| CVE-2015-4706 | Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path. | [email protected] | 6.1 | 1.63% | 2017-09-21 | 2026-06-16 |
| CVE-2015-4707 | Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path. | [email protected] | 6.1 | 1.76% | 2017-09-20 | 2026-06-16 |
| CVE-2015-5607 | Cross-site request forgery in the REST API in IPython 2 and 3. | [email protected] | 8.8 | 1.20% | 2017-09-20 | 2026-06-16 |
| CVE-2015-7337 | The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types. | [email protected] | 6.8 | 1.69% | 2015-09-29 | 2026-06-16 |
| CVE-2015-6938 | Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate. | [email protected] | 4.3 | 2.77% | 2015-09-21 | 2026-06-16 |
| CVE-2014-3429 | IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. | [email protected] | 6.8 | 4.67% | 2014-08-07 | 2026-06-16 |