Homepage
About Snyk

tqdm@4.4.3 vulnerabilities

Fast, Extensible Progress Meter

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the tqdm package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Injection

Affected versions of this package are vulnerable to Injection due to the handling of optional non-boolean CLI arguments such as --delim, --buf-size, --manpath through python's eval function. An attacker can execute arbitrary code by injecting malicious input into these arguments.

How to fix Injection?

Upgrade tqdm to version 4.66.3 or higher.

[,4.66.3)
  • H
Arbitrary Code Execution

tqdm is a Fast, Extensible Progress Meter.

Affected versions of this package are vulnerable to Arbitrary Code Execution due to using git insecurely. When importing tqdm, the tqdm._version module will run git log -n 1 --oneline in order to check if the user is running a pre-released version. An attacker can craft a repository with a malicious git log in the current working directory.

[,4.11.2)
Go back to all versions of this package