CVE-2024-8862: D-Tale Command Execution Vulnerability in dtale Package
Summary
CVE-2024-8862: D-Tale Command Execution Vulnerability. Affects dtale versions < 3.14.1. Fixed in 3.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
D-Tale is a powerful tool that combines a Flask back-end with a React front-end, enabling users to easily view and analyze Pandas data structures. It provides a user-friendly interface for data manipulation and visualization, making it a popular choice among data scientists and analysts. However, the package has a critical vulnerability that exposes it to command execution risks, particularly in its handling of query parameters.
Vulnerability Detail
The vulnerability arises from the way D-Tale processes query parameters in the route @dtale.route("/chart-data/<data_id>"). The parameters are directly passed to the run_query function without any sanitization or validation. This lack of processing allows an attacker to inject malicious queries that can be executed by the df.query method, leading to potential command execution on the server. The engine used is Python, which can execute arbitrary code, making this a significant security risk.
How To Fix
Latest published version: 3.22.0 as of 23 Oct 2026
pip install --upgrade "dtale==3.22.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.1
This is the first release that contains the fix.
pip install --upgrade "dtale==3.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization for the query parameters in your application before passing them to the run_query function. This can be done by restricting the types of queries that can be executed or by using a whitelist of allowed queries.
Conclusion
The D-Tale command execution vulnerability (CVE-2024-8862) poses a significant risk due to its potential for arbitrary code execution. Users are strongly advised to update to the latest version of the dtale package to mitigate this risk. Additionally, implementing input validation can provide temporary protection while awaiting updates.
See every vulnerability recorded for dtale →
FAQ
CVE-2024-8862 is a command execution vulnerability found in the D-Tale package that allows attackers to execute arbitrary commands through unsanitized query parameters.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary commands on the server, potentially leading to data breaches, unauthorized access, or complete system compromise.
Yes, you can implement input validation and sanitization for query parameters as a temporary measure to reduce the risk of exploitation until you can update the package.
The CVSS score for this vulnerability is 7.3, indicating a high severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for dtale.
