id: PYSEC-2017-45
details: Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows
  remote attackers to inject arbitrary web script or HTML via vectors involving JSON
  error messages and the /api/contents path.
affected:
- package:
    name: ipython
    ecosystem: PyPI
    purl: pkg:pypi/ipython
  ranges:
  - type: GIT
    repo: https://github.com/ipython/ipython
    events:
    - introduced: "0"
    - fixed: c2078a53543ed502efd968649fee1125e0eb549c
    - fixed: 7222bd53ad089a65fd610fab4626f9d0ab47dfce
  - type: ECOSYSTEM
    events:
    - introduced: 3.0.0
    - fixed: 3.2.0
  versions:
  - 3.0.0
  - 3.1.0
references:
- type: WEB
  url: https://ipython.org/ipython-doc/3/whatsnew/version3.html
- type: FIX
  url: https://github.com/ipython/ipython/commit/c2078a53543ed502efd968649fee1125e0eb549c
- type: FIX
  url: https://github.com/ipython/ipython/commit/7222bd53ad089a65fd610fab4626f9d0ab47dfce
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1235688
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2015/06/22/7
- type: WEB
  url: http://www.securityfocus.com/bid/75328
- type: ADVISORY
  url: https://github.com/advisories/GHSA-q326-jhw3-699g
aliases:
- CVE-2015-4706
- GHSA-q326-jhw3-699g
modified: "2021-07-15T02:22:14.767338Z"
published: "2017-09-21T14:29:00Z"