Description
D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| man-group | dtale | < 3.16.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
gduma-phData/patch-CVE-2024-55890 ★ 0 · Aug 24, 2026
Patch: Sandbox escape (macOS Kernel)
-
samh4cks/CVE-2024-55890 ★ 0 · Jun 13, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection http/cves/2024/CVE-2024-55890.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | dtale | < 3.16.1 | 3.16.1 | GHSA-832w-fhmw-w4f4 |