Skip to content
OpenAdvisories
Medium · 4.8 CVE-2024-34062 EUVD-2024-1621GHSA-g7vv-2v7x-gj9pPYSEC-2026-1976

tqdm CLI arguments injection attack

Published May 3, 2024 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: tqdm Product: tqdm Package: checkov Package: katib-controller Package: katib-controller-compat Package: katib-db-manager Package: katib-db-manager-compat Package: katib-earlystopping Package: katib-file-metricscollector Package: katib-file-metricscollector-compat Package: katib-suggestion-goptuna Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kubeflow-katib Package: py3-tqdm Package: py3-tqdm Package: python-tqdm Package: tqdm Package: tqdm Package: tqdm Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

VendorProductAffectedFixed
tqdm tqdm >= 4.4.0, < 4.66.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tqdm 4.66.4-1 —
Debian 13 tqdm 4.66.4-1 —
Debian 12 tqdm No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS tqdm 4.66.2-2ubuntu0.1~esm1 USN-7216-1
Ubuntu Pro 22.04 LTS tqdm 4.57.0-2ubuntu0.1~esm2 USN-7216-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 python-tqdm 4.66.4-150400.9.12.1 SUSE-SU-2024:1872-1
SLES 3 python-tqdm 4.66.4-150400.9.12.1 SUSE-SU-2024:1872-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 python-tqdm 4.66.4-150400.9.12.1 SUSE-SU-2024:1872-1
SLE HPC 15 SP4 python-tqdm 4.66.4-150400.9.12.1 SUSE-SU-2024:1872-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 python-tqdm 4.66.4-150400.9.12.1 SUSE-SU-2024:1872-1
openSUSE Leap 15.5 python-tqdm 4.66.4-150400.9.12.1 SUSE-SU-2024:1872-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 py3-tqdm 4.66.4-r0 —
Alpine v3.23 py3-tqdm 4.66.4-r0 —
Alpine v3.22 py3-tqdm 4.66.4-r0 —
Alpine v3.21 py3-tqdm 4.66.4-r0 —
Alpine v3.20 py3-tqdm 4.66.4-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-tqdm 4.61.1-1.amzn2023.0.3 ALAS2023-2024-690

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-tqdm 4.66.2-2 —
Azure Linux 2 (CBL-Mariner) python-tqdm 4.63.1-3 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling checkov 3.0.34-r1 —
Wolfi rolling kubeflow-katib +17 0.16.0-r9 —
Wolfi rolling py3-tqdm 4.66.4-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tqdm >= 4.4.0, < 4.66.3 4.66.3 GHSA-g7vv-2v7x-gj9p

Advisories 6

References