-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from tqdm's version checking mechanism in _version.py, which in affected versions executed 'git log' commands. This allowed attackers to craft a git repository with malicious configs (e.g., [gpg] program) that would execute arbitrary code when tqdm is imported. The GitHub issue #328 and subsequent fix in PR #330 confirm the vulnerable pattern was replaced with direct .git file parsing instead of executing git commands. Though the exact function name isn't specified in available resources, the version generation logic in _version.py is clearly identified as the vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tqdm | pip | = 4.4.1 | 4.11.2 |
| tqdm | pip | = 4.10.0 | 4.11.2 |
A Semantic Attack on Google Gemini - Read the Latest Research