Read the docs
TI-2024-30616 Aliases CVE-2024-45595GHSA-pw44-4h99-wqff

D-Tale allows Remote Code Execution through the Query input on Chart Builder

Priority MEDIUM 43CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00782 56th percentileScored 2026-11-07
Fix Fixed dtale (man-group): 3.14.1dtale (PyPI): 3.14.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
man-groupdtalebefore 3.14.13.14.1Patch availableCNA
—dtale (PyPI)before 3.14.13.14.1Patch availableGHSA-pw44-4h99-wqff
  • dtale Vendorman-group Affected before 3.14.1 Fixed in 3.14.1 Patch available CNA
  • dtale (PyPI) Vendor— Affected before 3.14.1 Fixed in 3.14.1 Patch available GHSA-pw44-4h99-wqff

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:*before 3.14.1Vulnerableman-group
  • cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:* Versions before 3.14.1 Vulnerable ·man-group

Remediation

  • Fix · CNA dtale (man-group) Fixed in 3.14.1
  • Fix · GHSA-pw44-4h99-wqff dtale (PyPI) Fixed in 3.14.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45595
  2. 2026-10-03 Alias added: GHSA-pw44-4h99-wqff

References

Patch 1

Advisory 2

Other 2

  • TI-2024-03179 Authentication Bypass and RCE in man-group/dtale CVSS 3.1CRITICAL 9.8
  • TI-2023-24776 D-Tale vulnerable to Remote Code Execution through the Custom Filter Input CVSS 3.1CRITICAL 9.8
  • TI-2026-21631 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint CVSS 4.0HIGH 8.1
  • TI-2024-14367 D-Tale server-side request forgery through Web uploads CVSS 3.1HIGH 7.5
  • TI-2026-27255 D-Tale affected by Remote Code Execution through redis/shelf storage CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences