| Package | Affected versions | Patched versions |
|---|---|---|
| dtale | < 3.14.1 | 3.14.1 |
| h2o | = 3.46.0.4 |
D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/<data_id>"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is python, which allows executing the query expression ans leading to a command execution vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free