TDQM Arbitrary Code Execution

HIGH 7.8CVE-2016-10075 · GHSA-r7q7-xcjw-qx8q · PYSEC-2017-74 · Published 19/01/2017 · updated 17/06/2026

In short

CVE-2016-10075 is a HIGH (CVSS 7.8) vulnerability affecting tqdm, tqdm (tqdm project).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.3% of all vulnerabilities.
Fix: update to 4.11.2 or later.

Package	Affected versions	Patched versions
tqdm PyPI	`≥ 4.10.0, < 4.11.2≥ 4.4.1, < 4.11.2< 4.11.2`	`4.11.2`
tqdm tqdm_project	`= 4.10= 4.4.1`	No fix yet

Description

The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.

NVD description

The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.

References

nvd.nist.gov/vuln/detail/CVE-2016-10075 · ADVISORY
tqdm/tqdm · WEB
tqdm/tqdm#330 · WEB
pypa/advisory-database · WEB
tqdm/tqdm · PACKAGE
security.gentoo.org/glsa/201807-01 · WEB
web.archive.org/web/20170214023533/http://www.securityfocus.com/bid/95143 · WEB
openwall.com/lists/oss-security/2016/12/28/8 · WEB
securityfocus.com/bid/95143 · Third Party Advisory
GitHub Advisory GHSA-r7q7-xcjw-qx8q · ADVISORY

More vulnerabilities in tqdm

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

tqdm

PyPI

≥ 4.10.0, < 4.11.2≥ 4.4.1, < 4.11.2< 4.11.2

4.11.2

tqdm

tqdm_project

= 4.10= 4.4.1

No fix yet

Description

The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.

NVD description

The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.