IPython Notebook vulnerable to improper validation of the origin of websocket requests

MEDIUM 6.8CVE-2014-3429 · GHSA-75cw-5cgv-g853 · PYSEC-2014-21 · Published 07/08/2014 · updated 17/06/2026

In short

CVE-2014-3429 is a MEDIUM (CVSS 6.8) vulnerability affecting ipython, ipython notebook (ipython).
Chance of exploitation in the next 30 days (EPSS): 4.7%, higher than 91.8% of all vulnerabilities.
Fix: update to 1.2.0 or later.

Package	Affected versions	Patched versions
ipython PyPI	`≥ 0.12, < 1.2.0`	`1.2.0`
ipython notebook ipython	`= 0.12= 0.12.1= 0.13= 0.13.1= 0.13.2= 1.0.0= 1.1.0`	No fix yet

Description

IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

NVD description

IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.