PT-2024-25674 · Tqdm+6 · Tqdm+6

Coppereagle · Published 2024-05-03 · Updated 2026-02-18 · CVE-2024-34062

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions tqdm versions prior to 4.66.3

Description tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable.

Recommendations For versions prior to 4.66.3, upgrade to version 4.66.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of optional non-boolean CLI arguments until a patch is applied.

Exploit

Fix

Special Elements Injection

Argument Injection

Weakness Enumeration

CWE-74

CWE-88

Related Identifiers

ALT-PU-2025-2199

AZL-40285

AZL-40307

BDU:2025-03340

CVE-2024-34062

GHSA-G7VV-2V7X-GJ9P

MGASA-2024-0299

OESA-2024-1554

OESA-2024-1555

OESA-2024-1658

OESA-2024-1659

OPENSUSE-SU-2024:13939-1

OPENSUSE-SU-2024_1872-1

SUSE-SU-2024:1872-1

SUSE-SU-2024_1872-1

USN-7216-1

Affected Products

Alt Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

Tqdm

References · 43

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34062.json · Exploit
• https://ubuntu.com/security/notices/USN-7216-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34062 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-34062 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34062 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-34062 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC · Vendor Advisory
• https://osv.dev/vulnerability/USN-7216-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1555 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1872-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-34062 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34062 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1659 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-40285 · Vendor Advisory