GitHub Advisoryadvisory · PyPI

GHSA-g7vv-2v7x-gj9p tqdm CLI arguments injection attack

LOW Published 2024-05-03 Modified 2024-06-10 Official page ↗

Aliases: CVE-2024-34062
Ecosystem: PyPI
Packages: tqdm
Severity: Low
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses: CWE-74
Reviewed: 2024-05-03

Affected packages

• PyPI tqdm: >= 4.4.0, < 4.66.3 → fixed in 4.66.3

Description

Impact Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example: ```sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \"" ``` Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3` Workarounds None References • https://github.com/tqdm/tqdm/releases/tag/v4.66.3

Related

Alias · CVE (1)

CVE-2024-34062 tqdm is an open source progress bar for Python and CLI. vulnerability

Weakness · CWE (1)

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References