CVE-2022-21699

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-250 CWE-279 CWE-269

Affected software

Vendor	Product	Versions
ipython	ipython	< 5.11; >= 6.0.0, < 7.16.3; >= 7.17.0, < 7.31.1; >= 8.0.0, < 8.0.1

References

https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668Patch, Third Party Advisory
https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5xExploit, Third Party Advisory
https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00021.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/
https://github.com/ipython/ipython/commit/46a51ed69cdf41b4333943d9ceeb945c4ede5668Patch, Third Party Advisory
https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5xExploit, Third Party Advisory
https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699Release Notes, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00021.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRQRTWHYXMLDJ572VGVUZMUPEOTPM3KB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZ7LVZBB4D7KVSFNEQUBEHFO3JW6D2ZK/

Timeline

Published: Jan 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21704.8The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing h CVE-2022-217005.3Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy CVE-2022-217018.8Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege esc CVE-2022-217025.4Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Graf CVE-2022-217038.8Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerabi CVE-2022-217045.5log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and da CVE-2022-217057.2Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized befo CVE-2022-217069.8Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insuffici CVE-2022-217078.1wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers CVE-2022-217086.5graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due CVE-2022-21715.4The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to ma CVE-2022-217106.1ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists i