CVE-2024-55890: D-Tale Remote Code Execution via Custom Filter Input
Summary
CVE-2024-55890: D-Tale allows Remote Code Execution through the Custom Filter Input. Affects dtale versions < 3.16.1. Fixed in 3.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
D-Tale is an open-source Python package that provides a web-based interface for visualizing and analyzing pandas data structures. It allows users to interact with their data in a user-friendly manner, offering features such as filtering, sorting, and plotting. However, due to a vulnerability in its custom filter functionality, D-Tale can be exploited by malicious users to execute arbitrary code on the server, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the enable_custom_filters flag in D-Tale, which, if enabled, allows users to input custom filters. This feature can be exploited by attackers to execute remote code on the server, leading to potential data breaches or server compromise. The issue is particularly critical for users who host D-Tale publicly, as it opens the door for unauthorized access and control over the server environment.
How To Fix
Latest published version: 3.22.0 as of 23 Oct 2026
pip install --upgrade "dtale==3.22.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.16.1
This is the first release that contains the fix.
pip install --upgrade "dtale==3.16.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade to version 3.16.1, the only workaround is to restrict access to D-Tale, ensuring it is only hosted for trusted users. This can help mitigate the risk of unauthorized access and potential exploitation.
Conclusion
The vulnerability identified as CVE-2024-55890 in D-Tale poses a serious risk of remote code execution through its custom filter input feature. Users are strongly advised to upgrade to version 3.16.1 to mitigate this risk. For those unable to upgrade, restricting access to trusted users is essential to protect against potential exploitation.
See every vulnerability recorded for dtale →
FAQ
D-Tale is a Python package that provides a web interface for visualizing and analyzing pandas data structures.
This vulnerability allows remote code execution through the custom filter input feature in D-Tale, potentially compromising the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot upgrade to version 3.16.1, ensure that D-Tale is only accessible to trusted users to minimize the risk of exploitation.
More information about the custom filter feature can be found in the D-Tale documentation at https://github.com/man-group/dtale#custom-filter.
References
Related vulnerabilities
Recent vulnerabilities recorded for dtale.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
