CVE-2024-34062: tqdm Package CLI Arguments Injection Vulnerability
Summary
CVE-2024-34062: tqdm CLI arguments injection attack. Affects tqdm versions >= 4.4.0, < 4.66.3. Fixed in 4.66.3. How to fix ↓
Also tracked for
- tqdm · Debian:11
The same CVE-2024-34062 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tqdm is a popular Python library that provides a fast, extensible progress bar for loops and command-line interfaces. It is widely used in data processing and machine learning tasks to give users visual feedback on the progress of their operations. However, a significant vulnerability has been identified that allows for arbitrary code execution through certain command-line interface (CLI) arguments.
Vulnerability Detail
The vulnerability arises from the handling of optional non-boolean CLI arguments in tqdm, such as --delim, --buf-size, and --manpath. These arguments are passed through Python's eval function, which can execute arbitrary code. This means that an attacker could craft a malicious command that, when executed, could run any Python code on the system. For example, an attacker could use the following command to execute arbitrary shell commands: python -m tqdm --manpath="" + str(exec("import os\nos.system('echo hi && killall python3')")) + "". This poses a severe risk as it could lead to unauthorized access or control over the system.
How To Fix
Latest published version: 4.70.1 as of 23 Oct 2026
pip install --upgrade "tqdm==4.70.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.66.3
This is the first release that contains the fix.
pip install --upgrade "tqdm==4.66.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no workarounds available for this vulnerability. The best course of action is to update to the patched version of tqdm.
Conclusion
The tqdm package has a critical vulnerability that allows for arbitrary code execution through certain CLI arguments. It is essential to update to the patched version (4.66.3 or later) to mitigate this risk. Users should remain vigilant and monitor their applications for potential vulnerabilities using tools like Vulert.
See every vulnerability recorded for tqdm →
FAQ
The vulnerability allows for arbitrary code execution through certain CLI arguments due to the use of Python's eval function.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 3.9, indicating a moderate level of severity.
Yes, a patch is available in tqdm version 4.66.3 and later. It is recommended to upgrade to this version.
If you cannot update the package immediately, be cautious with the use of tqdm and avoid passing untrusted input as CLI arguments until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for tqdm.
