D-Tale Command Execution Vulnerability
D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/<data_id>"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is python, which allows executing the query expression ans leading to a command execution vulnerability.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | dtale | < 3.14.1 | 3.14.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8862
- https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8
- https://github.com/man-group/dtale
- https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Command-Execution-via-Panda-df-query-9dc40f0477ee4b65806de7921876c222?pvs=4
- https://vuldb.com/?ctiid.277499
- https://vuldb.com/?id.277499
- https://vuldb.com/?submit.403200
- https://pypi.org/project/dtale
- https://github.com/advisories/GHSA-fg5m-m723-7mv6
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-74- Platform
- Python (PyPI)
- Package
dtale- Disclosed
- 16.09.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1321 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-fg5m-m723-7mv6 - CC BY 4.0
Vulnerability history: dtale
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 10.2023 04.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 5
Disclosures per year
- 2023: 1
- 2024: 5
- 2025: 0
- 2026: 2
-
D-Tale Command Execution Vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.