---
id: CVE-2024-55890
aliases:
  - GHSA-832w-fhmw-w4f4
  - PYSEC-2026-1320
title: D-Tale allows Remote Code Execution through the Custom Filter Input
summary: D-Tale allows Remote Code Execution through the Custom Filter Input
severity: medium
vendor: dtale
product: dtale
ecosystem: pip
affected:
  - dtale < 3.16.1
patched:
  - dtale 3.16.1
published: '2024-12-13'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:56.295840229Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-832w-fhmw-w4f4'
references:
  - url: 'https://github.com/man-group/dtale/security/advisories/GHSA-832w-fhmw-w4f4'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-55890'
  - url: >-
      https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a
  - url: 'https://github.com/man-group/dtale'
  - url: 'https://github.com/man-group/dtale#custom-filter'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.024
epssPercentile: 0.83302
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/samh4cks/CVE-2024-55890'
    - 'https://github.com/gduma-phData/patch-CVE-2024-55890'
  nuclei:
    - CVE-2024-55890
  checkedAt: '2026-09-25T08:20:43.597Z'
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:47.278Z'
---

## Overview

### Impact
Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

### Patches
Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. You can find out more information on how to turn that flag on [here](https://github.com/man-group/dtale#custom-filter)

### Workarounds
The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

### References
See "Custom Filter" [documentation](https://github.com/man-group/dtale#custom-filter)


## Affected packages

- `dtale < 3.16.1`

## Remediation

Upgrade to a patched release:

- `dtale 3.16.1`