Vulnerability · Published Sep 10, 2024 · Assigned by GitHub_M
CVE-2024-45595D-Tale allows Remote Code Execution through the Query input on Chart Builder
Medium 6.1
In plain English
A medium-severity cross-site scripting in dtale from man-group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.8%top 43.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | dtale | 3.14.1 | GHSA-pw44-4h99-wqff |
| PyPI | dtale | 3.14.1 | PYSEC-2026-1323 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/man-group/dtale/security/advisories/GHSA-pw44-4h99-wqff x_refsource_CONFIRM
- https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8 x_refsource_MISC
- https://github.com/man-group/dtale#custom-filter x_refsource_MISC