~ / search / GHSA-g7vv-2v7x-gj9p

GHSA-g7vv-2v7x-gj9p

tqdm CLI arguments injection attack

Source: GitHub Advisory Database (reviewed) Low CVE-2024-34062

Packages

EcosystemPackageAffectedFixed in
PyPI tqdm >= 4.4.0, < 4.66.3 4.66.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example: ```sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \"" ``` ### Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3` ### Workarounds None ### References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3

References

External links from the advisory. They lead to third-party sites.