Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example: Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in tqdm=4.66.3 Workarounds None References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3
Recommended action: Upgrade to 4.66.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The tqdm.version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
Recommended action: Upgrade to 4.11.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.