CVE-2024-34062 tqdm CLI arguments injection attack
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-34062?
CVE-2024-34062 is a medium-severity vulnerability in tqdm, published on 3 May 2024.
Official description
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-74
Which versions are affected by CVE-2024-34062?
3 open source packages ship an affected version, including tqdm.
| Package | Affected | Fixed in |
|---|---|---|
tqdm PyPI | From 4.4.0 | 4.66.3 |
tqdm PyPI | From 4.4.0 | 4.66.3 |
tqdm PyPI | From 4.4.0 | 4.66.3 |
Linux distribution packages (9)
python-tqdm SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.66.4-150400.9.12.1 |
python-tqdm SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 4.66.4-150400.9.12.1 |
python-tqdm SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 4.66.4-150400.9.12.1 |
python-tqdm SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 4.66.4-150400.9.12.1 |
python-tqdm SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 4.66.4-150400.9.12.1 |
python-tqdm SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 4.66.4-150400.9.12.1 |
python-tqdm SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 4.66.4-150400.9.12.1 |
python-tqdm openSUSE:Leap 15.5 | All versions | 4.66.4-150400.9.12.1 |
python-tqdm openSUSE:Leap 15.6 | All versions | 4.66.4-150400.9.12.1 |
How do I fix CVE-2024-34062?
Upgrade tqdm to 4.66.3 or later.
Is CVE-2024-34062 being exploited?
There is no known exploitation of CVE-2024-34062 in the wild and no public exploit code.
Sources
Also known as AZL-40285, AZL-40307, CLSA-2025-1758672759, DEBIAN-CVE-2024-34062, GHSA-g7vv-2v7x-gj9p, MGASA-2024-0299 and 9 more.