Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1qcTZjLXI5eGYtcXhqbc4AA2ob
dtale vulnerable to Remote Code Execution through the Custom Filter Input
Impact
Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.
Patches
Users should upgrade to version 3.7.0 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back on here
Workarounds
The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.
References
See "Custom Filter" documentation
Permalink: https://github.com/advisories/GHSA-jq6c-r9xf-qxjmJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcTZjLXI5eGYtcXhqbc4AA2ob
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 7 months ago
Updated: 6 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-jq6c-r9xf-qxjm, CVE-2023-46134
References:
- https://github.com/man-group/dtale/security/advisories/GHSA-jq6c-r9xf-qxjm
- https://github.com/man-group/dtale/commit/bf8c54ab2490803f45f0652a9a0e221a94d39668
- https://nvd.nist.gov/vuln/detail/CVE-2023-46134
- https://github.com/advisories/GHSA-jq6c-r9xf-qxjm
Blast Radius: 11.8
Affected Packages
pypi:dtale
Dependent packages: 13Dependent repositories: 87
Downloads: 49,111 last month
Affected Version Ranges: < 3.7.0
Fixed in: 3.7.0
All affected versions: 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.7.10, 1.7.11, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.8.0, 1.8.1, 1.8.3, 1.8.4, 1.8.6, 1.8.7, 1.8.8, 1.8.9, 1.8.10, 1.8.11, 1.8.12, 1.8.13, 1.8.14, 1.8.15, 1.8.16, 1.8.17, 1.8.18, 1.8.19, 1.9.0, 1.9.1, 1.9.2, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.13.0, 1.14.0, 1.14.1, 1.15.2, 1.16.0, 1.17.0, 1.18.0, 1.18.1, 1.18.2, 1.19.0, 1.19.1, 1.19.2, 1.20.0, 1.21.0, 1.21.1, 1.22.0, 1.22.1, 1.23.0, 1.24.0, 1.25.0, 1.26.0, 1.27.0, 1.28.0, 1.28.1, 1.29.0, 1.29.1, 1.30.0, 1.31.0, 1.32.0, 1.32.1, 1.33.0, 1.33.1, 1.34.0, 1.35.0, 1.36.0, 1.37.0, 1.37.1, 1.38.0, 1.39.0, 1.40.0, 1.40.1, 1.40.2, 1.41.0, 1.41.1, 1.42.0, 1.42.1, 1.43.0, 1.44.0, 1.44.1, 1.45.0, 1.46.0, 1.47.0, 1.48.0, 1.49.0, 1.50.0, 1.50.1, 1.51.0, 1.52.0, 1.53.0, 1.54.0, 1.54.1, 1.55.0, 1.56.0, 1.57.0, 1.58.1, 1.58.2, 1.58.3, 1.59.0, 1.59.1, 1.60.1, 1.60.2, 1.61.0, 1.61.1, 2.0.0, 2.1.0, 2.1.2, 2.2.0, 2.3.0, 2.4.0, 2.5.1, 2.6.0, 2.7.1, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.10.0, 2.11.0, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.13.0, 2.14.0, 2.14.1, 2.15.0, 2.15.2, 2.16.0, 3.0.0, 3.1.0, 3.1.6, 3.1.7, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0
All unaffected versions: 3.7.0, 3.8.0, 3.8.1, 3.9.0, 3.10.0, 3.11.0, 3.12.0