tqdm CLI arguments injection attack
Priority LOW 24CWE-74Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Partial tqdm (tqdm): 4.66.3tqdm (PyPI): 4.66.3Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tqdm | tqdm | 4.4.0 to before 4.66.3 | 4.66.3 | Patch available | CNA |
| — | tqdm (PyPI) | 4.4.0 to before 4.66.3 | 4.66.3 | Patch available | GHSA-g7vv-2v7x-gj9p |
- tqdm Vendortqdm Affected 4.4.0 to before 4.66.3 Fixed in 4.66.3 Patch available CNA
- tqdm (PyPI) Vendor— Affected 4.4.0 to before 4.66.3 Fixed in 4.66.3 Patch available GHSA-g7vv-2v7x-gj9p
Remediation
- Fix · CNA tqdm (tqdm) Fixed in 4.66.3
- Fix · GHSA-g7vv-2v7x-gj9p tqdm (PyPI) Fixed in 4.66.3 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 3 | Affected | No fix yet |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34062
- 2026-10-03 Alias added: GHSA-g7vv-2v7x-gj9p
References
Other 9
- https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p
- https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6/
- https://github.com/tqdm/tqdm
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC
Sources
- CVE-2024-34062 · CVE Program
- CVE-2024-34062 · NVD
- FIRST EPSS
- GHSA-g7vv-2v7x-gj9p · GitHub Advisory Database · CC BY 4.0
- CVE-2024-34062 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences