# CVE-2024-55890: D-Tale - RCE

> Live exploitation tracking for CVE-2024-55890 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-55890

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.9
- **Public exploit available:** Yes
- **Affected products:** Man-group D-Tale
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** python, web_application

## Description

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

## CrowdSec analysis

[CVE-2024-55890](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-55890) is a vulnerability in D-Tale versions before 3.16.1 that can allow unauthenticated remote code execution when the application is publicly accessible. Attackers may exploit the `update-settings` endpoint to modify the `enable_custom_filters` setting and execute malicious code on the hosting server, potentially compromising application integrity and exposing connected resources. Updating to version 3.16.1 or restricting access to trusted users mitigates the risk.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-55890 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers upload a CSV file to `/dtale/upload` to obtain a `data_id`, enable custom filters through `/dtale/update-settings/{data_id}`, and then target `/dtale/test-filter/{data_id}` with a crafted `query` parameter containing Python/Pandas expression injection, often invoking `os` and an outbound `curl` request for remote code execution.

## Timeline

- 2024-12-13: CVE Published. CVE-2024-55890 is published to NVD.
- 2026-08-25: Rule Released. CrowdSec releases a rule to detect CVE-2024-55890 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/man-group/dtale#custom-filter
- https://github.com/man-group/dtale/security/advisories/GHSA-832w-fhmw-w4f4
- https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55890.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-55890) follows observed exploitation activity for CVE-2024-55890. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.