---
id: CVE-2024-8862
aliases:
  - GHSA-fg5m-m723-7mv6
  - PYSEC-2026-1321
title: D-Tale Command Execution Vulnerability
summary: D-Tale Command Execution Vulnerability
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
vendor: dtale
product: dtale
ecosystem: pip
affected:
  - dtale < 3.14.1
patched:
  - dtale 3.14.1
published: '2024-09-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:18.904509027Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fg5m-m723-7mv6'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8862'
  - url: >-
      https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8
  - url: 'https://github.com/man-group/dtale'
  - url: >-
      https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Command-Execution-via-Panda-df-query-9dc40f0477ee4b65806de7921876c222?pvs=4
  - url: 'https://vuldb.com/?ctiid.277499'
  - url: 'https://vuldb.com/?id.277499'
  - url: 'https://vuldb.com/?submit.403200'
tags:
  - osv
  - pip
epss: 0.01328
epssPercentile: 0.69819
ingestedAt: '2026-07-08T18:25:48.889Z'
---

## Overview

D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/<data_id>"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is `python`, which allows executing the query expression ans leading to a command execution vulnerability. 

## Affected packages

- `dtale < 3.14.1`

## Remediation

Upgrade to a patched release:

- `dtale 3.14.1`