CVE-2024-34062: 
Python vulnerability analysis and mitigation

tqdm, an open source progress bar for Python and CLI, was found to contain a security vulnerability identified as CVE-2024-34062. The vulnerability was discovered and disclosed in May 2024, affecting all versions prior to 4.66.3. The issue exists in the way tqdm handles optional non-boolean CLI arguments, potentially affecting any system with tqdm installed (NVD, GitHub Advisory).

The vulnerability stems from the improper handling of non-boolean CLI arguments (such as --delim, --buf-size, --manpath) which are passed through Python's eval function without proper sanitization. This implementation has been classified as CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L (NVD).

The vulnerability allows for arbitrary code execution in the local context. An attacker with local access could exploit this vulnerability by crafting specific input to the CLI arguments, potentially leading to unauthorized code execution on the affected system (GitHub Advisory).

The vulnerability is locally exploitable and requires user interaction. An example exploit involves passing specially crafted input to the --manpath argument that can lead to arbitrary code execution. The attack requires local access to the system and the ability to execute the tqdm command-line interface (GitHub Advisory).

The vulnerability has been patched in tqdm version 4.66.3 and later. Users are strongly advised to upgrade to the latest version. There are no known workarounds for this vulnerability other than upgrading to a patched version. Various Linux distributions have also released security updates to address this vulnerability, including Ubuntu and Fedora (Ubuntu Notice, Fedora Update).