GHSA-jq6c-r9xf-qxjm: dtale vulnerable to Remote Code Execution through the Custom Filter Input

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-46134

dtale vulnerable to Remote Code Execution through the Custom Filter Input

Moderate severity GitHub Reviewed Published Oct 24, 2023 in man-group/dtale • Updated Oct 25, 2023

Affected versions

< 3.7.0

Description

Impact

Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

Patches

Users should upgrade to version 3.7.0 where the “Custom Filter” input is turned off by default. You can find out more information on how to turn it back on here

Workarounds

The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

References

See “Custom Filter” documentation

References

• GHSA-jq6c-r9xf-qxjm
• man-group/dtale@bf8c54a

Published to the GitHub Advisory Database

Oct 25, 2023

Last updated

Oct 25, 2023