Every CVE Search/ Get API key

CVE-2024-55890

D-Tale allows Remote Code Execution through the Custom Filter Input

6.9 MediumPublic exploitFix available

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

2.42%Up 2.4 points since Dec 14, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.9

D-Tale allows Remote Code Execution through the Custom Filter Input

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Record
CVE-2024-55890
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-3447 6.9

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Record
EUVD-2024-3447
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-832w-fhmw-w4f4 6.9

D-Tale allows Remote Code Execution through the Custom Filter Input

Impact

Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

Patches

Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. You can find out more information on how to turn that flag on here

Workarounds

The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

References

See "Custom Filter" documentation

Record
GHSA-832w-fhmw-w4f4
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
NVD 6.9

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Record
CVE-2024-55890
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
OSV 6.9

D-Tale allows Remote Code Execution through the Custom Filter Input

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Record
CVE-2024-55890
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-832w-fhmw-w4f4 6.9

D-Tale allows Remote Code Execution through the Custom Filter Input

Impact

Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

Patches

Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. You can find out more information on how to turn that flag on here

Workarounds

The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

References

See "Custom Filter" documentation

Record
GHSA-832w-fhmw-w4f4
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-1320 6.9

D-Tale allows Remote Code Execution through the Custom Filter Input

Impact

Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

Patches

Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. You can find out more information on how to turn that flag on here

Workarounds

The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

References

See "Custom Filter" documentation

Record
PYSEC-2026-1320
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dtale
PyPI
 before 3.16.1
3.16.1
dtale
PyPI
 before 3.16.1, plus listed versions
1.0.01.1.11.10.01.11.01.12.1
Show 45 moreShow less
1.13.01.14.11.15.21.16.01.17.01.18.21.19.21.2.01.20.01.21.11.22.01.22.11.23.01.24.01.25.01.26.01.27.01.28.01.28.11.29.01.29.11.3.71.30.01.31.01.32.01.32.11.33.01.33.11.34.01.35.01.36.01.37.01.37.11.38.01.39.01.4.11.40.01.40.11.40.21.41.01.41.11.42.01.42.11.43.01.44.0
3.16.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiD-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection
PoC in GitHubgduma-phData/patch-CVE-2024-558902026-08-24
PoC in GitHubsamh4cks/CVE-2024-558902025-06-13

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-55890 is a medium vulnerability (CVSS 6.9) in Man-group Dtale, published December 13, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in dtale 3.16.1.

References

This page doesn't list everything

Left out here: 117 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open