{"action":"Upgrade tqdm to 4.11.2 or later.","affected":[{"fixed":"4.11.2","introduced":"0"}],"component":"tqdm","cve_ids":["CVE-2016-10075"],"ecosystem":"PyPI","epss":0.00438,"exploited":false,"fixed_versions":["4.11.2"],"ghsa_id":"GHSA-r7q7-xcjw-qx8q","id":"tcs_01M5KG7FW91EZF597VVRSZGX6J","modified_at":"2026-06-10T17:02:44.390372289Z","published_at":"2017-01-19T20:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-74","https://github.com/tqdm/tqdm/issues/328","http://www.securityfocus.com/bid/95143","http://www.openwall.com/lists/oss-security/2016/12/28/8","https://security.gentoo.org/glsa/201807-01","https://github.com/advisories/GHSA-r7q7-xcjw-qx8q"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2017-74","url":"https://osv.dev/vulnerability/PYSEC-2017-74"},{"source":"nvd","source_id":"CVE-2016-10075","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10075"}],"summary":"The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory."}