CVE-2024-21642
D-Tale server-side request forgery through Web uploads
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
D-Tale server-side request forgery through Web uploads
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
- Record
CVE-2024-21642- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2024-0283
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
- Record
EUVD-2024-0283- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7hfx-h3j3-rwq4
D-Tale server-side request forgery through Web uploads
Impact
Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server.
Patches
Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn it back on here
Workarounds
The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
References
See "Load Data & Sample Datasets" documentation
- Record
GHSA-7hfx-h3j3-rwq4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
- Record
CVE-2024-21642- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
D-Tale server-side request forgery through Web uploads
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
- Record
CVE-2024-21642- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-7hfx-h3j3-rwq4
D-Tale server-side request forgery through Web uploads
Impact
Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server.
Patches
Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn it back on here
Workarounds
The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
References
See "Load Data & Sample Datasets" documentation
- Record
GHSA-7hfx-h3j3-rwq4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVPYSEC-2026-1319
D-Tale server-side request forgery through Web uploads
Impact
Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server.
Patches
Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn it back on here
Workarounds
The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
References
See "Load Data & Sample Datasets" documentation
- Record
PYSEC-2026-1319- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dtalePyPI |
before 3.9.0 | 3.9.0 |
dtalePyPI |
before 3.9.0, plus listed versions 1.0.01.1.11.10.01.11.01.12.1 Show 45 moreShow less1.13.01.14.11.15.21.16.01.17.01.18.21.19.21.2.01.20.01.21.11.22.01.22.11.23.01.24.01.25.01.26.01.27.01.28.01.28.11.29.01.29.11.3.71.30.01.31.01.32.01.32.11.33.01.33.11.34.01.35.01.36.01.37.01.37.11.38.01.39.01.4.11.40.01.40.11.40.21.41.01.41.11.42.01.42.11.43.01.44.0 |
3.9.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21642 is a high vulnerability (CVSS 7.5) in Man D-tale, published January 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in dtale 3.9.0.
References
github.com/man-group/dtale/security/advisories/GHSA-7hfx-h3j3-rwq4
nvd.nist.gov/vuln/detail/CVE-2024-21642
pypi.org/project/dtale
Left out here: 106 versions. The JSON record has them.