The vulnerability stems from tqdm's version checking mechanism in _version.py, which in affected versions executed 'git log' commands. This allowed attackers to craft a git repository with malicious configs (e.g., [gpg] program) that would execute arbitrary code when tqdm is imported. The GitHub issue #328 and subsequent fix in PR #330 confirm the vulnerable pattern was replaced with direct .git file parsing instead of executing git commands. Though the exact function name isn't specified in available resources, the version generation logic in _version.py is clearly identified as the vulnerable component.