{"id":"CVE-2024-34062","aliases":["GHSA-g7vv-2v7x-gj9p","PYSEC-2026-1976"],"title":"tqdm CLI arguments injection attack","summary":"tqdm CLI arguments injection attack","severity":"low","cvss":3.9,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","vendor":"tqdm","product":"tqdm","ecosystem":"pip","affected":["tqdm >= 4.4.0, < 4.66.3"],"patched":["tqdm 4.66.3"],"published":"2024-05-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:13.776534451Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-g7vv-2v7x-gj9p","references":[{"url":"https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34062"},{"url":"https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316"},{"url":"https://github.com/tqdm/tqdm"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC"}],"tags":["osv","pip"],"epss":0.00436,"epssPercentile":0.37342,"ingestedAt":"2026-07-08T18:25:49.665Z","slug":"CVE-2024-34062","body":"## Overview\n\n### Impact\nAny optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:\n\n```sh\npython -m tqdm --manpath=\"\\\" + str(exec(\\\"import os\\nos.system('echo hi && killall python3')\\\")) + \\\"\"\n```\n\n### Patches\nhttps://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3`\n\n### Workarounds\nNone\n\n### References\n- https://github.com/tqdm/tqdm/releases/tag/v4.66.3\n\n## Affected packages\n\n- `tqdm >= 4.4.0, < 4.66.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tqdm 4.66.3`","depth":"sunlit","depthScore":22,"depthScoreParts":{"impact":21.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}