CVE-2024-34062Low· 3.9▾ Sunlittqdm CLI arguments injection attack
▾ Sunlit zone — Low / medium · no exploitation signal
impact 21.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
0.4% → 0.4%
Last analysed / modified upstream
Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example:
python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""
https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in tqdm>=4.66.3
None
tqdm >= 4.4.0, < 4.66.3Upgrade to a patched release:
tqdm 4.66.3Connected by shared product, vendor, weakness, or advisory.