CVE-2024-8862: D-Tale Command Execution Vulnerability
Summary
CVE-2024-8862: D-Tale Command Execution Vulnerability. Affects dtale versions < 3.14.1. Fixed in 3.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
D-Tale is an open-source tool that combines a Flask back-end with a React front-end, providing users with an intuitive interface to view and analyze Pandas data structures. It allows data scientists and analysts to interact with their data seamlessly, offering features like data visualization and manipulation. However, due to its architecture, it is susceptible to command execution vulnerabilities if proper input validation is not enforced.
Vulnerability Detail
The vulnerability arises from the way D-Tale handles query parameters in the route @dtale.route("/chart-data/<data_id>"). The parameters are directly passed to the run_query function without any sanitization or validation. This oversight allows an attacker to craft malicious queries that can be executed by the df.query method, leading to potential command execution on the server. The engine used is Python, which can execute arbitrary code, making this a critical security risk.
How To Fix
Latest published version: 3.22.0 as of 23 Oct 2026
pip install --upgrade "dtale==3.22.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.14.1
This is the first release that contains the fix.
pip install --upgrade "dtale==3.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization for the query parameters before they are passed to the run_query function. This can be done by using a whitelist of acceptable query formats or by escaping potentially dangerous characters.
Conclusion
The D-Tale command execution vulnerability (CVE-2024-8862) poses a significant risk due to improper handling of query parameters. It is crucial to update to the patched version 3.14.1 or later to safeguard your application. Additionally, consider using Vulert for ongoing monitoring of vulnerabilities in your software dependencies.
See every vulnerability recorded for dtale →
FAQ
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the server, potentially leading to data breaches or system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
If you cannot update the package right away, implement input validation and sanitization as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for dtale.
