CVE-2025-0655 – dtale

Package

Manager: pip
Name: dtale
Vulnerable Version: <0

Severity

Level: Critical

CVSS v3.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: N/A

EPSS: N/A pctlN/A

Details

Duplicate Advisory: D-Tale Command Injection vulnerability ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-832w-fhmw-w4f4. This link is maintained to preserve external references. ## Original Description A vulnerability in man-group/dtale versions 3.15.1 allows an attacker to override global state settings to enable the `enable_custom_filters` feature, which is typically restricted to trusted environments. Once enabled, the attacker can exploit the /test-filter endpoint to execute arbitrary system commands, leading to remote code execution (RCE). This issue is addressed in version 3.16.1.

Metadata

Created: 2025-03-20T12:32:52Z
Modified: 2025-04-15T21:45:58Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-gjxm-x497-4h6h/GHSA-gjxm-x497-4h6h.json
CWE IDs: ["CWE-77", "CWE-78"]
Alternative ID: GHSA-gjxm-x497-4h6h
Finding: F422
Auto approve: 1