Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nN3Z2LTJ2N3gtZ2o5cM4AA7v0

tqdm CLI arguments injection attack

Impact

Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example:

python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""

Patches

https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in tqdm>=4.66.3

Workarounds

None

References

• https://github.com/tqdm/tqdm/releases/tag/v4.66.3

Permalink: https://github.com/advisories/GHSA-g7vv-2v7x-gj9p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nN3Z2LTJ2N3gtZ2o5cM4AA7v0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: 7 months ago
Updated: 6 months ago

CVSS Score: 3.9
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Identifiers: GHSA-g7vv-2v7x-gj9p, CVE-2024-34062
References:

• https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p
• https://nvd.nist.gov/vuln/detail/CVE-2024-34062
• https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316
• https://lists.fedoraproject.org/archives/list/[email protected]/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6
• https://lists.fedoraproject.org/archives/list/[email protected]/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6
• https://lists.fedoraproject.org/archives/list/[email protected]/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC
• https://github.com/advisories/GHSA-g7vv-2v7x-gj9p

Repository: https://github.com/tqdm/tqdm
Blast Radius: 20.0

Affected Packages