Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.22.0. Workarounds There are no workarounds for versions < 3.22.0
Recommended action: Upgrade to 3.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.20.0. Workarounds There are no workarounds for versions < 3.20.0
Recommended action: Upgrade to 3.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enablecustomfilters flag. You can find out more information on how to turn that flag on here Workarounds The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users. References See "Custom Filter" documentation
Recommended action: Upgrade to 3.16.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/<dataid"), the query parameters from the request are directly passed into runquery for execution. And the runquery function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is python, which allows executing the query expression ans leading to a command execution vulnerability.
Recommended action: Upgrade to 3.14.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back on here Workarounds The only workaround for versions earlier than 3.14.1 is to only host D-Tale to trusted users. References See "Custom Filter" documentation
Recommended action: Upgrade to 3.14.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server. Patches Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn it back on here Workarounds The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users. References See "Load Data & Sample Datasets" documentation
Recommended action: Upgrade to 3.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.7.0 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back on here Workarounds The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users. References See "Custom Filter" documentation
Recommended action: Upgrade to 3.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.