CVE-2024-34062

Severity CVSS v4.0:

Pending analysis

Type:

CWE-74 Injection

Publication date:

03/05/2024

Last modified:

15/04/2026

Description

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python&#39;s `eval`, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact

Vector 3.x

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS v3.1 Severity and Metrics:

Base Score: 4.80 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): Low
Availability (A): Low

Base Score 3.x

4.80

Severity 3.x

MEDIUM

CVE-2024-34062

Description

Impact

References to Advisories, Solutions, and Tools