CVE-2016-10075: tqdm Arbitrary Code Execution
Summary
CVE-2016-10075: The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory. Affects tqdm versions < 4.11.2. Fixed in 4.11.2. How to fix ↓
Also tracked for
- tqdm · Debian:11
The same CVE-2016-10075 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tqdm package is a Python library that provides a fast, extensible progress bar for loops and other iterable objects. It is commonly used to visualize the progress of tasks in command-line interfaces. The vulnerability identified as CVE-2016-10075 affects tqdm versions 4.4.1 and 4.10. It allows local users to execute arbitrary code by exploiting a flaw in the tqdm._version module. An attacker can achieve this by crafting a repository with a malicious git log in the current working directory.
Vulnerability Detail
The vulnerability in tqdm arises from a lack of proper input validation in the tqdm._version module. By manipulating the git log of a repository, an attacker can inject and execute arbitrary code on the local system. This can lead to unauthorized access, data breaches, or the execution of malicious commands. It is important to note that this vulnerability only affects local users with access to the current working directory. Remote exploitation is not possible.
How To Fix
Minimum fixed version
4.11.2
This is the first release that contains the fix.
pip install --upgrade "tqdm==4.11.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is advisable to avoid running untrusted code or opening repositories from untrusted sources in the current working directory.
Conclusion
The tqdm package versions 4.4.1 and 4.10 are vulnerable to arbitrary code execution when a malicious git log is present in the current working directory. To mitigate this vulnerability, it is crucial to upgrade to tqdm version 4.11.2 or later. It is also recommended to exercise caution when dealing with untrusted code or repositories. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tqdm →
FAQ
tqdm is a Python library that provides a progress bar for loops and iterable objects. It helps visualize the progress of tasks in command-line interfaces.
The vulnerability affects tqdm versions 4.4.1 and 4.10.
An attacker can exploit this vulnerability by crafting a repository with a malicious git log in the current working directory. When a user with access to the directory runs tqdm, the malicious code can be executed.
The vulnerability allows for arbitrary code execution, which can lead to unauthorized access, data breaches, or the execution of malicious commands on the local system.
No, this vulnerability can only be exploited by local users with access to the current working directory.
Related vulnerabilities
Recent vulnerabilities recorded for tqdm.
