Skip to content

tqdm CLI arguments injection attack

Low severity GitHub Reviewed Published May 2, 2024 in tqdm/tqdm • Updated Jun 10, 2024

Package

pip tqdm (pip)

Affected versions

>= 4.4.0, < 4.66.3

Patched versions

4.66.3

Description

Impact

Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example:

python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""

Patches

tqdm/tqdm@4e613f8 released in tqdm>=4.66.3

Workarounds

None

References

References

@casperdcl casperdcl published to tqdm/tqdm May 2, 2024
Published by the National Vulnerability Database May 3, 2024
Published to the GitHub Advisory Database May 3, 2024
Reviewed May 3, 2024
Last updated Jun 10, 2024

Severity

Low
3.9
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2024-34062

GHSA ID

GHSA-g7vv-2v7x-gj9p

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.