Patchfirst
Patchfirst
CVE-2024-55890 Public exploit Medium · 6.9 EPSS 2.4%

D-Tale allows Remote Code Execution through the Custom Filter Input

man-group · dtale

Official description · CVE.org

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Breakdown
66.7 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 20 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+20 mo

See the family tree

3 related vulnerabilities in the same code over 14 months. The latest fix listed for dtale is 3.22.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2023-46134D-Tale vulnerable to Remote Code Execution through the Custom…25 Oct 2023
  2. relatedHigh

    Why these are linked:

    • Fixed one release later3.7.0 → 3.9.0 (dtale)
    • Same code patched: __init__.py, app.py, config.py, global_state.py, base.html (machine-matched)Functions: AppSettings, base_render_template, build_show_options, load_app_settings, set_app_settingscommit bf8c54acommit 954f6be
    CVE-2024-21642D-Tale server-side request forgery through Web uploads5 Jan 2024
  3. relatedMedium

    Why these are linked:

    This CVECVE-2024-55890D-Tale allows Remote Code Execution through the Custom Filter…13 Dec 2024

Fixes in dtalePyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3.9.0CVE-2024-216425 Jan 2024
  2. 3.14.1CVE-2024-4559510 Sep 2024
  3. 3.14.1CVE-2024-886214 Sep 2024
  4. 3.16.1CVE-2024-5589013 Dec 2024
  5. 3.20.0CVE-2026-2719421 Feb 2026
  6. 3.22.0CVE-2026-350526 Apr 2026Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: dtale.

PyPIdtaleGHSA-832w-fhmw-w4f4PYSEC-2026-1320

Upgrade to 3.16.1

Still affected on this line by CVE-2024-3408 (no fix published).

pippip install "dtale>=3.16.1"

The first fix for CVE-2024-55890.

Affected versions

If you runUpgrade to
All versions before 3.16.13.16.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/man-group/dtale/security/advisories/GHSA-832w-fhmw-w4f4

x_refsource_MISC 2

github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7agithub.com/man-group/dtale#custom-filter
↑ ↓ chooseEnter openEsc close