Most recent entries from all

bdu:2025-03340

BREW-airshare-CVE-2024-34062 — tqdm CLI arguments injection attack

Affected: Homebrew: airshare

### Impact Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:

```sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \"" ```

### Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3`

### Workarounds None

### References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3

certfr-2024-avi-0579 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0579

EUVD-2026-217410

fkie_cve-2024-34062

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-g7vv-2v7x-gj9p — tqdm CLI arguments injection attack

Affected: PyPI: tqdm

### Impact Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:

```sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \"" ```

### Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3`

### Workarounds None

### References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3

msrc_CVE-2024-34062 — tqdm CLI arguments injection attack

msrc_CVE-2024-34062

OESA-2024-1554 — python-tqdm security update

Affected: openEuler:22.03-LTS: python-tqdm

tqdm derives from the Arabic word taqaddum which can mean "progress". Instantly make your loops show a smart progress meter - just wrap any iterable with tqdm(interable), and you are done! Security Fix(es): tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-34062)

openSUSE-SU-2024:13939-1 — python-tqdm-bash-completion-4.66.4-1.1 on GA media

python-tqdm-bash-completion-4.66.4-1.1 on GA media

PYSEC-2026-1976 — tqdm CLI arguments injection attack

Affected: PyPI: tqdm

### Impact Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allowing arbitrary code execution. Example:

```sh python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \"" ```

### Patches https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 released in `tqdm>=4.66.3`

### Workarounds None

### References - https://github.com/tqdm/tqdm/releases/tag/v4.66.3

UBUNTU-CVE-2024-34062

Affected: Ubuntu:Pro:22.04:LTS: tqdm, Ubuntu:Pro:24.04:LTS: tqdm

WID-SEC-W-2024-1488 — IBM InfoSphere Information Server: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.