CVE-2024-34062: tqdm CLI arguments injection attack
Impact Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example:
sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""
Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in tqdm>=4.66.3
Workarounds None
References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3
Other sources
tqdm could allow a local authenticated attacker to execute arbitrary code on the system, caused by a CLI arguments injection . By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34062?
CVE-2024-34062 has a high severity rating due to the potential for arbitrary code execution via non-boolean CLI arguments.
How do I fix CVE-2024-34062?
To fix CVE-2024-34062, upgrade to tqdm version 4.66.3 or later.
Which software is affected by CVE-2024-34062?
CVE-2024-34062 affects versions of tqdm from 4.4.0 to 4.66.3, as well as specific versions of IBM Cloud Pak for Security and QRadar Suite Software.
Is there a workaround for CVE-2024-34062?
There are no known effective workarounds for CVE-2024-34062; the best solution is to upgrade to a secured version.
What type of vulnerability is CVE-2024-34062?
CVE-2024-34062 is classified as a code injection vulnerability, enabling arbitrary code execution through manipulated CLI arguments.