GitHub Advisoryadvisory · PyPI

GHSA-r7q7-xcjw-qx8q TDQM Arbitrary Code Execution

HIGH Published 2022-05-14 Modified 2024-11-18 Official page ↗
Aliases
CVE-2016-10075
Ecosystem
PyPI
Packages
tqdm
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2023-07-28

Affected packages

• PyPI tqdm: >= 4.4.1, < 4.11.2 → fixed in 4.11.2 • PyPI tqdm: >= 4.10.0, < 4.11.2 → fixed in 4.11.2

Description

The `tqdm._version` module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.

Related

Alias · CVE (1)

  • CVE-2016-10075 The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References