CVE-2016-10075
TDQM Arbitrary Code Execution
CVE-2016-10075 is a high vulnerability (CVSS 7.8) in Tqdm Project Tqdm, published January 19, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in tqdm 4.11.2.
- Severity
- 7.8 HighCVSS 3.0, NVD
- Exploit chance
- 0.44%EPSS, 38th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.11.2tqdm +7 more
Description
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tqdmPyPI | 4.4.1 to 4.4.1 | 4.11.2 |
tqdmPyPI | 4.10.0 to 4.10.0 | 4.11.2 |
tqdmDebian:12 | before 4.11.2-1 | 4.11.2-1 |
tqdmDebian:13 | before 4.11.2-1 | 4.11.2-1 |
tqdmDebian:14 | before 4.11.2-1 | 4.11.2-1 |
tqdmPyPI | 4.4.1 up to 4.11.2, plus listed versions 4.10.04.11.04.11.14.4.34.5.0 Show 13 moreShow less4.5.24.6.14.6.24.7.04.7.14.7.24.7.44.7.64.8.14.8.24.8.34.8.44.9.0 | 4.11.2 |
tqdmPyPI | 4.10.0 up to 4.11.2, plus listed versions 4.11.04.11.1 | 4.11.2 |
tqdmPyPI | before 4.11.2, plus listed versions 1.02.0.02.0.0.dev02.2.32.2.4 Show 27 moreShow less3.1.33.1.43.4.03.7.03.7.13.8.04.1.04.10.04.11.04.11.14.4.04.4.14.4.34.5.04.5.24.6.14.6.24.7.04.7.14.7.24.7.44.7.64.8.14.8.24.8.34.8.44.9.0 | 4.11.2 |
What each source reports
NVD Score used
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
CVE-2016-10075- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-17
- Updated
- 2026-11-02
CVE ListNo score
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
CVE-2016-10075- Updated
- 2026-11-02
EUVDEUVD-2017-0136No score
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
EUVD-2017-0136- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r7q7-xcjw-qx8q
TDQM Arbitrary Code Execution
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
GHSA-r7q7-xcjw-qx8q- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
CVE-2016-10075- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10075
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
DEBIAN-CVE-2016-10075- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-r7q7-xcjw-qx8q
TDQM Arbitrary Code Execution
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
GHSA-r7q7-xcjw-qx8q- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10075
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
UBUNTU-CVE-2016-10075- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11276-1No score
python-tqdm-bash-completion-4.62.2-1.2 on GA media
These are all security issues fixed in the python-tqdm-bash-completion-4.62.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11276-1- Updated
- 2026-11-02
OSVPYSEC-2017-74No score
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
- Record
PYSEC-2017-74- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
security.gentoo.org/glsa/201807-01
github.com/tqdm/tqdm/issues/328
securityfocus.com/bid/95143
openwall.com/lists/oss-security/2016/12/28/8
nvd.nist.gov/vuln/detail/CVE-2016-10075
Show 8 moreShow less
web.archive.org/web/20170214023533/http://www.securityfocus.com/bid/95143
security-tracker.debian.org/tracker/CVE-2016-10075
ubuntu.com/security/CVE-2016-10075
cve.org/CVERecord?id=CVE-2016-10075
suse.com/security/cve/CVE-2016-10075