CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2024-55890Public Exploit

D-Tale - RCE (CVE-2024-55890)

PublishedDec 13, 2024
First SeenN/A
Last Seen
Reported
CVSS6.9
Man-group
Man-groupD-Tale
pythonweb_application

Description

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

psychologyCrowdSec Analysis

CVE-2024-55890 is a vulnerability in D-Tale versions before 3.16.1 that can allow unauthenticated remote code execution when the application is publicly accessible. Attackers may exploit the update-settings endpoint to modify the enable_custom_filters setting and execute malicious code on the hosting server, potentially compromising application integrity and exposing connected resources. Updating to version 3.16.1 or restricting access to trusted users mitigates the risk.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-55890 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers upload a CSV file to /dtale/upload to obtain a data_id, enable custom filters through /dtale/update-settings/{data_id}, and then target /dtale/test-filter/{data_id} with a crafted query parameter containing Python/Pandas expression injection, often invoking os and an outbound curl request for remote code execution.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2024-12-13
Rule Released2026-08-25

Related Weaknesses

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References