CVE-2024-45595: D-Tale allows Remote Code Execution through the Query input on Chart Builder

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-10 · updated 2026-06-17
Weakness: CWE-79

Description

D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default.

Affected products

Man D-Tale: before 3.14.1 — fixed in 3.14.1

How to fix

Upgrade to a fixed version: Man D-Tale 3.14.1. Check the vendor advisory for mitigations.

References

https://github.com/man-group/dtale#custom-filter
https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8
https://github.com/man-group/dtale/security/advisories/GHSA-pw44-4h99-wqff

Get alerted when CVE-2024-45595 or the next vulnerability affects your stack