nlohmann/json

CVE-2024-34062

eugrin opened this issue · 0 comments

eugrin commented

Description

Impact
Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example:

python -m tqdm --manpath="" + str(exec("import os\nos.system('echo hi && killall python3')")) + ""
Patches
tqdm/tqdm@4e613f8 released in tqdm>=4.66.3

Workarounds
None

References
https://github.com/tqdm/tqdm/releases/tag/v4.66.3

Recommendation
Upgrade tqdm from 4.66.1 to 4.66.3 to fix the vulnerability.

Reproduction steps

NA

Expected vs. actual results

NA

Minimal code example

No response

Error messages

No response

Compiler and operating system

Not related to compiler

Library version

4.66.1

Validation