GHSA-g7vv-2v7x-gj9p
tqdm CLI arguments injection attack
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2024-34062
- Alias
- PYSEC-2026-1976
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Description
### Impact Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example: ```sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \"" ``` ### Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3` ### Workarounds None ### References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · tqdm | introduced 4.4.0, fixed 4.66.3 |
Références
- https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-34062 ADVISORY
- https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 WEB
- https://github.com/tqdm/tqdm PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |