{"id":"CVE-2016-10075","aliases":["GHSA-r7q7-xcjw-qx8q","PYSEC-2017-74"],"title":"TDQM Arbitrary Code Execution","summary":"TDQM Arbitrary Code Execution","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"tqdm","product":"tqdm","ecosystem":"pip","affected":["tqdm >= 4.4.1, < 4.11.2","tqdm >= 4.10.0, < 4.11.2"],"patched":["tqdm 4.11.2","tqdm 4.11.2"],"published":"2022-05-14","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:40.289529890Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-r7q7-xcjw-qx8q","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10075"},{"url":"https://github.com/tqdm/tqdm/issues/328"},{"url":"https://github.com/tqdm/tqdm/pull/330"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/tqdm/PYSEC-2017-74.yaml"},{"url":"https://github.com/tqdm/tqdm"},{"url":"https://security.gentoo.org/glsa/201807-01"},{"url":"https://web.archive.org/web/20170214023533/http://www.securityfocus.com/bid/95143"},{"url":"http://www.openwall.com/lists/oss-security/2016/12/28/8"}],"tags":["osv","pip"],"epss":0.0046,"epssPercentile":0.39068,"ingestedAt":"2026-09-12T03:13:01.725Z","slug":"CVE-2016-10075","body":"## Overview\n\nThe `tqdm._version` module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.\n\n## Affected packages\n\n- `tqdm >= 4.4.1, < 4.11.2`\n- `tqdm >= 4.10.0, < 4.11.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tqdm 4.11.2`\n- `tqdm 4.11.2`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}