CVE-2024-8862High· 7.3▾ TwilightD-Tale Command Execution Vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.3%
Last analysed / modified upstream
D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/<data_id>"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is python, which allows executing the query expression ans leading to a command execution vulnerability.
dtale < 3.14.1Upgrade to a patched release:
dtale 3.14.1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-45595Medium· 6.1D-Tale vulnerable to Remote Code Execution through the Query input on Chart Builder
CVE-2026-27194HighD-Tale affected by Remote Code Execution through the /save-column-filter endpoint
CVE-2026-35052MediumD-Tale: Remote Code Execution through redis/shelf storage
CVE-2023-46134Medium· 6.1dtale vulnerable to Remote Code Execution through the Custom Filter Input
CVE-2024-55890MediumD-Tale allows Remote Code Execution through the Custom Filter Input
CVE-2024-21642High· 7.5D-Tale server-side request forgery through Web uploads