GHSA-g7vv-2v7x-gj9p: tqdm CLI arguments injection attack

Skip to content

Navigation Menu

Sign in

CVE-2024-34062

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

Explore

*   All features
*   Documentation
*   GitHub Skills
*   Blog

• For

  • Enterprise
  • Teams
  • Startups
  • Education

  By Solution

  • CI/CD & Automation
  • DevOps
  • DevSecOps

  Resources

  • Learning Pathways
  • White papers, Ebooks, Webinars
  • Customer Stories
  • Partners

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles
    

Repositories

*   Topics
*   Trending
*   Collections

• Pricing

Search code, repositories, users, issues, pull requests…

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches****Use saved searches to filter your results more quickly

Sign in

Sign up

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-34062

tqdm CLI arguments injection attack

Low severity GitHub Reviewed Published May 2, 2024 in tqdm/tqdm • Updated May 3, 2024

Vulnerability details Dependabot alerts 0

Package

pip tqdm (pip)

Affected versions

>= 4.4.0, < 4.66.3

Patched versions

4.66.3

Description

Impact

Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python’s eval, allowing arbitrary code execution. Example:

python -m tqdm --manpath="\" + str(exec(\"import os\nos.system(‘echo hi && killall python3’)\")) + \""

Patches

tqdm/tqdm@4e613f8 released in tqdm>=4.66.3

Workarounds

None

References

• https://github.com/tqdm/tqdm/releases/tag/v4.66.3

References

• GHSA-g7vv-2v7x-gj9p
• https://nvd.nist.gov/vuln/detail/CVE-2024-34062
• tqdm/tqdm@4e613f8

casperdcl published to tqdm/tqdm

May 2, 2024

Published by the National Vulnerability Database

May 3, 2024

Published to the GitHub Advisory Database

May 3, 2024

Reviewed

May 3, 2024

Last updated

May 3, 2024

Severity

Low

3.9

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weaknesses

CWE-74

CVE ID

CVE-2024-34062

GHSA ID

GHSA-g7vv-2v7x-gj9p

Source code

tqdm/tqdm

Checking history

See something to contribute? Suggest improvements for this vulnerability.