AVID-2026-R1576

Description

D-Tale allows Remote Code Execution through the Custom Filter Input (CVE-2024-55890)

Details

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.

Reason for inclusion in AVID: CVE-2024-55890 affects D-Tale, a Python data visualization tool commonly used within ML/AI data pipelines. The vulnerability enables remote code execution when D-Tale is hosted publicly prior to version 3.16.1, with a fix in 3.16.1 that blocks the ability to update the enable_custom_filters flag. This is a software vulnerability in a component that can be part of AI workflows (data exploration, dashboards, etc.), impacting the software supply chain for AI systems. It concerns RCE (security/safety vulnerability) and has explicit remediation guidance and references, providing sufficient signal for AVID curation.

References

Affected or Relevant Artifacts

Developer: man-group
Deployer: man-group
Artifact Details:

Type	Name
System	dtale

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CWE

ID	Description
CWE-79	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-12-13
Version: 0.3.3
AVID Entry