CVE-2024-21642

D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the `Load From the Web` input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.

• CWE-918

• https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2Patch
• https://github.com/man-group/dtale/security/advisories/GHSA-7hfx-h3j3-rwq4Patch, Vendor Advisory
• https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasetsProduct
• https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2Patch
• https://github.com/man-group/dtale/security/advisories/GHSA-7hfx-h3j3-rwq4Patch, Vendor Advisory
• https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasetsProduct

Published

Jan 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21636view_component is a framework for building reusable, testabl…6.1
• CVE-2024-21637Authentik is an open-source Identity Provider. Authentik is …5.4
• CVE-2024-21638Azure IPAM (IP Address Management) is a lightweight solution…9.8
• CVE-2024-21639CEF (Chromium Embedded Framework ) is a simple framework for…9.6
• CVE-2024-21640Chromium Embedded Framework (CEF) is a simple framework for …9.6
• CVE-2024-21641Flarum is open source discussion platform software. Prior to…4.7
• CVE-2024-21643IdentityModel Extensions for .NET provide assemblies for web…8.8
• CVE-2024-21644pyLoad is the free and open-source Download Manager written …7.5
• CVE-2024-21645pyLoad is the free and open-source Download Manager written …5.3
• CVE-2024-21646Azure uAMQP is a general purpose C library for AMQP 1.0. The…9.8
• CVE-2024-21647Puma is a web server for Ruby/Rack applications built for pa…7.5
• CVE-2024-21648XWiki Platform is a generic wiki platform offering runtime s…8.8