FIX CVE-2022-21699

See https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x

IPython/__init__.py

@@ -58,6 +58,10 b" __author__ = '%s <%s>' % (release.author, release.author_email)"
 __license__  = release.license
 __version__  = release.version
 version_info = release.version_info
+# list of CVEs that should have been patched in this release.
+# this is informational and should not be relied upon.
+__patched_cves__ = {"CVE-2022-21699"}
+
 
 def embed_kernel(module=None, local_ns=None, **kwargs):
     """Embed and start an IPython kernel in a given scope.

IPython/core/application.py

@@ -134,7 +134,7 b' class BaseIPythonApplication(Application):'
     config_file_paths = List(Unicode())
     @default('config_file_paths')
     def _config_file_paths_default(self):
-        return [py3compat.getcwd()]
+        return []
 
     extra_config_file = Unicode(
     help="""Path to an extra config file to load.

IPython/core/profileapp.py

@@ -184,9 +184,9 b' class ProfileList(Application):'
         profiles = list_profiles_in(py3compat.getcwd())
         if profiles:
             print()
-            print("Available profiles in current directory (%s):" % py3compat.getcwd())
-            self._print_profiles(profiles)
-        
+            print(
+                "Profiles from CWD have been removed for security reason, see CVE-2022-21699:"
+            )
         print()
         print("To use any of the above profiles, start IPython with:")
         print("    ipython --profile=<name>")

IPython/core/profiledir.py

@@ -187,7 +187,7 b' class ProfileDir(LoggingConfigurable):'
         is not found, a :class:`ProfileDirError` exception will be raised.
 
         The search path algorithm is:
-        1. ``py3compat.getcwd()``
+        1. ``os.getcwd()`` # removed for security reason.
         2. ``ipython_dir``
 
         Parameters
@@ -199,7 +199,7 b' class ProfileDir(LoggingConfigurable):'
             will be "profile_<profile>".
         """
         dirname = u'profile_' + name
-        paths = [py3compat.getcwd(), ipython_dir]
+        paths = [ipython_dir]
         for p in paths:
             profile_dir = os.path.join(p, dirname)
             if os.path.isdir(profile_dir):

docs/source/whatsnew/version5.rst

@@ -2,6 +2,14 b''
  5.x Series
 ============
 
+
+.. _whatsnew5101
+
+IPython 5.10.1 (CVE-2022-21699)
+===============================
+
+Fix CVE-2022-21699, see IPython 8.0.1 release notes.
+
 .. _whatsnew5100
 
 IPython 5.10.0