VDB
Sign up
LOW3.9

PYSEC-2026-1976

tqdm CLI arguments injection attack

Quick fix

PYSEC-2026-1976 — tqdm: upgrade to the fixed version with the command below.

pip install --upgrade 'tqdm>=4.66.3'

Details

### Impact Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:

```sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \"" ```

### Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3`

### Workarounds None

### References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/tqdm
Introduced in: 4.4.0Fixed in: 4.66.3
Fixpip install --upgrade 'tqdm>=4.66.3'

References