Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Jul 2021 14:39:33 -0600
From: Mats Wichmann <>
Subject: Re: ipython3 may execute code from the current working

On 7/22/21 5:35 AM, Jakub Wilk wrote:
> * Georgi Guninski <>, 2021-07-22, 11:52:
>> Summary: under certain circumstances, ipython3 may execute code from 
>> the current working directory.
> Looks like this might be intentional? Or at least there's an option to 
> turn off this behavior:

normally (cpython), an empty string in sys.path doesn't mean "current 
directory", it means "script directory", the directory the script you're 
running is found in [1].  that only falls back to current directory in 
case there is no script directory - which happens if you invoke the 
interpreter interactively . So maybe ipython isn't interpreting this the 
same way?

there have been more than one security concern about the way this makes 
it possible for untrusted modules to get loaded.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.