GitHub Advisoryadvisory · PyPI

GHSA-fg5m-m723-7mv6 D-Tale Command Execution Vulnerability

MEDIUM Published 2024-09-16 Modified 2024-09-20 Official page ↗
Aliases
CVE-2024-8862
Ecosystem
PyPI
Packages
dtale
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-74
Reviewed
2024-09-20

Affected packages

• PyPI dtale: < 3.14.1 → fixed in 3.14.1

Description

D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is `python`, which allows executing the query expression ans leading to a command execution vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-8862 A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References