{"id":"CVE-2024-34062","aliases":["ALPINE-CVE-2024-34062","AZL-40285","AZL-40307","CLSA-2025-1758672759","DEBIAN-CVE-2024-34062","EUVD-2024-1621","GHSA-g7vv-2v7x-gj9p","MGASA-2024-0299","OESA-2024-1554","OESA-2024-1555","OESA-2024-1658","OESA-2024-1659","PYSEC-2026-1976","SUSE-SU-2024:1872-1","UBUNTU-CVE-2024-34062","USN-7216-1","openSUSE-SU-2024:13939-1"],"status":"published","title":"tqdm CLI arguments injection attack","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00436,"percentile":0.38301,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2024-05-03T09:55:26Z","modified":"2026-11-03T06:32:45Z","fixes":[{"ecosystem":"PyPI","package":"tqdm","fixed_in":["4.66.3"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-tqdm","fixed_in":["4.66.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-tqdm","fixed_in":["4.66.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-tqdm","fixed_in":["4.66.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-tqdm","fixed_in":["4.66.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-tqdm","fixed_in":["4.66.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-tqdm","fixed_in":["4.66.2-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-tqdm","fixed_in":["4.63.1-3"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"tqdm","fixed_in":["4.66.1.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tqdm","fixed_in":["4.66.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tqdm","fixed_in":["4.66.4-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-tqdm","fixed_in":["4.64.1-2.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-tqdm","fixed_in":["4.56.0-4.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-tqdm","fixed_in":["4.56.0-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-tqdm","fixed_in":["4.56.0-4.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-tqdm","fixed_in":["4.56.0-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-tqdm","fixed_in":["4.66.4-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tqdm","fixed_in":["4.57.0-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tqdm","fixed_in":["4.66.2-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.66.3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.63.1-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.66.1"},{"fixed":"4.66.1.post1+tuxcare"}]}],"versions":["4.66.1"]},{"source":"osv","ecosystem":"Debian:12","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.64.1-1","4.64.1-2","4.64.1-3","4.64.1-4","4.66.2-1","4.66.2-2","4.66.2-3","4.66.4-1","4.66.4-2","4.66.5-1","4.67.0-1","4.67.1-1","4.67.1-2","4.67.1-3","4.67.1-4","4.67.1-5","4.67.1-6","4.67.1-7","4.67.2-1","4.67.2-2","4.67.3-1","4.68.2-1","4.68.3-1","4.68.3-2","4.68.4-1","4.69.0-1","4.70.0-1","4.70.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.66.3"}]}],"versions":["4.10.0","4.11.0","4.11.1","4.11.2","4.12.0","4.13.0","4.14.0","4.15.0","4.16.0","4.17.0","4.17.1","4.18.0","4.19.1","4.19.1.post1","4.19.2","4.19.4","4.19.5","4.19.6","4.19.7","4.19.8","4.19.9","4.20.0","4.21.0","4.22.0","4.23.0","4.23.1","4.23.2","4.23.3","4.23.4","4.24.0","4.25.0","4.26.0","4.27.0","4.28.0","4.28.1","4.29.0","4.29.1","4.30.0","4.31.0","4.31.1","4.32.0","4.32.1","4.32.2","4.33.0","4.34.0","4.35.0","4.36.0","4.36.1","4.37.0","4.38.0","4.39.0","4.4.0","4.4.1","4.4.3","4.40.0","4.40.1","4.40.2","4.41.0","4.41.1","4.42.0","4.42.1","4.43.0","4.44.0","4.44.1","4.45.0","4.46.0","4.46.1","4.47.0","4.48.0","4.48.1","4.48.2","4.49.0","4.5.0","4.5.2","4.50.0","4.50.1","4.50.2","4.51.0","4.52.0","4.53.0","4.54.0","4.54.1","4.55.0","4.55.1","4.55.2","4.56.0","4.56.1","4.56.2","4.57.0","4.58.0","4.59.0","4.6.1","4.6.2","4.60.0","4.61.0","4.61.1","4.61.2","4.62.0","4.62.1","4.62.2","4.62.3","4.63.0","4.63.1","4.63.2","4.64.0","4.64.1","4.65.0","4.65.1","4.65.2","4.66.0","4.66.1","4.66.2","4.7.0","4.7.1","4.7.2","4.7.4","4.7.6","4.8.1","4.8.2","4.8.3","4.8.4","4.9.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.64.1-2.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.56.0-4.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.56.0-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.56.0-4.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.56.0-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.66.3"}]}],"versions":["4.10.0","4.11.0","4.11.1","4.11.2","4.12.0","4.13.0","4.14.0","4.15.0","4.16.0","4.17.0","4.17.1","4.18.0","4.19.1","4.19.1.post1","4.19.2","4.19.4","4.19.5","4.19.6","4.19.7","4.19.8","4.19.9","4.20.0","4.21.0","4.22.0","4.23.0","4.23.1","4.23.2","4.23.3","4.23.4","4.24.0","4.25.0","4.26.0","4.27.0","4.28.0","4.28.1","4.29.0","4.29.1","4.30.0","4.31.0","4.31.1","4.32.0","4.32.1","4.32.2","4.33.0","4.34.0","4.35.0","4.36.0","4.36.1","4.37.0","4.38.0","4.39.0","4.4.0","4.4.1","4.4.3","4.40.0","4.40.1","4.40.2","4.41.0","4.41.1","4.42.0","4.42.1","4.43.0","4.44.0","4.44.1","4.45.0","4.46.0","4.46.1","4.47.0","4.48.0","4.48.1","4.48.2","4.49.0","4.5.0","4.5.2","4.50.0","4.50.1","4.50.2","4.51.0","4.52.0","4.53.0","4.54.0","4.54.1","4.55.0","4.55.1","4.55.2","4.56.0","4.56.1","4.56.2","4.57.0","4.58.0","4.59.0","4.6.1","4.6.2","4.60.0","4.61.0","4.61.1","4.61.2","4.62.0","4.62.1","4.62.2","4.62.3","4.63.0","4.63.1","4.63.2","4.64.0","4.64.1","4.65.0","4.65.1","4.65.2","4.66.0","4.66.1","4.66.2","4.7.0","4.7.1","4.7.2","4.7.4","4.7.6","4.8.1","4.8.2","4.8.3","4.8.4","4.9.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP5","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.4-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.57.0-2ubuntu0.1~esm2"}]}],"versions":["4.57.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.2-2ubuntu0.1~esm1"}]}],"versions":["4.64.1-1","4.64.1-2","4.66.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.57.0-2ubuntu0.1~esm2"}]}],"versions":["4.57.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tqdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.66.2-2ubuntu0.1~esm1"}]}],"versions":["4.64.1-1","4.64.1-2","4.66.2-2"]}],"products":[{"vendor":"tqdm","product":"tqdm"}],"references":[{"url":"https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p","tags":["x_refsource_CONFIRM","x_transferred","advisory","web","report"]},{"url":"https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34062","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g7vv-2v7x-gj9p","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-34062","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34062.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-34062","tags":["advisory"]},{"url":"https://github.com/tqdm/tqdm","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0299.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33533","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2024-August/019257.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1554","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1555","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1658","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1659","tags":["advisory"]},{"url":"https://pypi.org/project/tqdm","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241872-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223880","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34062","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-34062","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34062","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7216-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-34062","title":"tqdm CLI arguments injection attack","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T09:55:26.119Z","modified":"2025-02-13T17:52:21.881Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-1621","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T09:55:26Z","modified":"2025-02-13T17:52:21Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:31.829035Z"}],"ghsa":[{"id":"GHSA-g7vv-2v7x-gj9p","title":"tqdm CLI arguments injection attack","description":"### Impact\nAny optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:\n\n```sh\npython -m tqdm --manpath=\"\\\" + str(exec(\\\"import os\\nos.system('echo hi \u0026\u0026 killall python3')\\\")) + \\\"\"\n```\n\n### Patches\nhttps://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm\u003e=4.66.3`\n\n### Workarounds\nNone\n\n### References\n- https://github.com/tqdm/tqdm/releases/tag/v4.66.3","status":"published","published":"2024-05-03T19:33:28Z","modified":"2024-06-10T18:30:58Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2024-34062","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T10:15:08.5Z","modified":"2026-06-17T07:32:49.983Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:09:56.122111Z"}],"osv":[{"id":"ALPINE-CVE-2024-34062","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T10:15:08.5Z","modified":"2026-11-03T06:32:45.460567312Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2024-34062","title":"tqdm CLI arguments injection attack","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T09:55:26.119Z","modified":"2026-10-28T02:31:09.470270632Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-34062","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T10:15:08.5Z","modified":"2026-11-02T12:02:31.676028445Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-g7vv-2v7x-gj9p","title":"tqdm CLI arguments injection attack","description":"### Impact\nAny optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:\n\n```sh\npython -m tqdm --manpath=\"\\\" + str(exec(\\\"import os\\nos.system('echo hi \u0026\u0026 killall python3')\\\")) + \\\"\"\n```\n\n### Patches\nhttps://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm\u003e=4.66.3`\n\n### Workarounds\nNone\n\n### References\n- https://github.com/tqdm/tqdm/releases/tag/v4.66.3","status":"published","published":"2024-05-03T19:33:28Z","modified":"2026-09-10T03:50:13.776534451Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"OESA-2024-1554","title":"python-tqdm security update","description":"tqdm derives from the Arabic word taqaddum which can mean \u0026quot;progress\u0026quot;. Instantly  make your loops show a smart progress meter - just wrap any iterable with  tqdm(interable), and you are done!\r\n\r\nSecurity Fix(es):\r\n\r\ntqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python\u0026apos;s `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-34062)","status":"published","published":"2024-05-10T11:07:00Z","modified":"2026-08-18T01:18:25.318698233Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1555","title":"python-tqdm security update","description":"tqdm derives from the Arabic word taqaddum which can mean \u0026quot;progress\u0026quot;. Instantly  make your loops show a smart progress meter - just wrap any iterable with  tqdm(interable), and you are done!\r\n\r\nSecurity Fix(es):\r\n\r\ntqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python\u0026apos;s `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-34062)","status":"published","published":"2024-05-10T11:07:01Z","modified":"2026-08-18T01:18:25.33661345Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1658","title":"python-tqdm security update","description":"tqdm derives from the Arabic word taqaddum which can mean \u0026quot;progress\u0026quot;. Instantly  make your loops show a smart progress meter - just wrap any iterable with  tqdm(interable), and you are done!\r\n\r\nSecurity Fix(es):\r\n\r\ntqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python\u0026apos;s `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-34062)","status":"published","published":"2024-05-24T11:07:07Z","modified":"2026-08-18T01:17:22.952875599Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1659","title":"python-tqdm security update","description":"tqdm derives from the Arabic word taqaddum which can mean \u0026quot;progress\u0026quot;. Instantly  make your loops show a smart progress meter - just wrap any iterable with  tqdm(interable), and you are done!\r\n\r\nSecurity Fix(es):\r\n\r\ntqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python\u0026apos;s `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-34062)","status":"published","published":"2024-05-24T11:07:07Z","modified":"2026-08-18T01:17:22.496390517Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"PYSEC-2026-1976","title":"tqdm CLI arguments injection attack","description":"### Impact\nAny optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:\n\n```sh\npython -m tqdm --manpath=\"\\\" + str(exec(\\\"import os\\nos.system('echo hi \u0026\u0026 killall python3')\\\")) + \\\"\"\n```\n\n### Patches\nhttps://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm\u003e=4.66.3`\n\n### Workarounds\nNone\n\n### References\n- https://github.com/tqdm/tqdm/releases/tag/v4.66.3","status":"published","published":"2026-07-07T11:45:41.0602Z","modified":"2026-07-07T17:48:11.555580867Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2024-34062","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T10:15:00Z","modified":"2026-02-04T04:20:56.650356Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"AZL-40285","title":"CVE-2024-34062 affecting package python-tqdm for versions less than 4.66.2-2","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T10:15:08Z","modified":"2026-06-02T05:26:23Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-40307","title":"CVE-2024-34062 affecting package python-tqdm for versions less than 4.63.1-3","description":"tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-05-03T10:15:08Z","modified":"2026-04-21T04:28:59.625102Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CLSA-2025-1758672759","title":"TuxCare security update for tqdm (1 CVE)","description":"TuxCare rebuilt tqdm to address 1 CVE. Fixed in 4.66.1.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:47:53.477509147Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"MGASA-2024-0299","title":"Updated python-tqdm package fixes security vulnerability","description":"Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`,\n`--manpath`) are passed through python's `eval`, allowing arbitrary code\nexecution. This issue is only locally exploitable.\n","status":"published","published":"2024-09-13T17:15:41Z","modified":"2026-04-16T04:44:23.919723927Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13939-1","title":"python-tqdm-bash-completion-4.66.4-1.1 on GA media","description":"These are all security issues fixed in the python-tqdm-bash-completion-4.66.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:47:22.807933Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1872-1","title":"Security update for python-tqdm","description":"This update for python-tqdm fixes the following issues:\n\nUpdate to version 4.66.4:\n\n* rich: fix completion\n* cli: eval safety (CVE-2024-34062, bsc#1223880)\n* pandas: add DataFrame.progress_map\n* notebook: fix HTML padding\n* keras: fix resuming training when verbose\u003e=2\n* fix format_num negative fractions missing leading zero\n* fix Python 3.12 DeprecationWarning on import\n","status":"published","published":"2024-05-30T14:30:50Z","modified":"2026-02-04T02:40:55.973212Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-7216-1","title":"tqdm vulnerability","description":"It was discovered that tqdm did not properly sanitize non-boolean CLI\nArguments. A local attacker could possibly use this issue to execute\narbitrary code on the host. This issue only affected Ubuntu 22.04 LTS and\nUbuntu 24.04 LTS. (CVE-2024-34062)\n","status":"published","published":"2025-01-16T22:21:57Z","modified":"2026-04-27T17:40:09.95211Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}