PT-2024-25674 · Tqdm+6 · Tqdm+6
CVSS v3.1
4.8
Medium
| Vector | AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
tqdm versions prior to 4.66.3
Description
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g.
--delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable.Recommendations
For versions prior to 4.66.3, upgrade to version 4.66.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of optional non-boolean CLI arguments until a patch is applied.
Exploit
Fix
DoS
Argument Injection
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Debian
Linuxmint
Red Os
Suse
Ubuntu
Tqdm