CVE-2024-45595 D-Tale allows Remote Code Execution through the Query input on Chart Builder

What is CVE-2024-45595?

CVE-2024-45595 is a medium-severity code injection vulnerability in man-group dtale, published on 10 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default.

Weakness: CWE-79

Which versions are affected by CVE-2024-45595?

3 open source packages ship an affected version, including dtale. It affects 1 product.

Products include Man D-Tale.

How do I fix CVE-2024-45595?

Upgrade dtale to 3.14.1 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-45595 being exploited?

There is no known exploitation of CVE-2024-45595 in the wild and no public exploit code.

Other vulnerabilities in man-group dtale

• CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale Critical 9.8
• CVE-2026-27194 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint High 8.1
• CVE-2024-21642 D-Tale server-side request forgery through Web uploads High 7.5
• CVE-2023-46134 D-Tale vulnerable to Remote Code Execution through the Custom Filter Input Medium 6.1
• CVE-2026-35052 D-Tale affected by Remote Code Execution through redis/shelf storage Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2024-9016, GHSA-pw44-4h99-wqff, PYSEC-2026-1323.