CVE-2024-55890
Published: 13 December 2024
Summary
CVE-2024-55890 is a medium-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Data Processing Libraries; in the Not Applicable risk domain.
Deeper analysis
D-Tale, a visualizer for pandas data structures, contains a remote code execution vulnerability in all versions prior to 3.16.1. The flaw resides in the update-settings endpoint, which previously allowed unauthenticated modification of the enable_custom_filters flag and thereby exposed servers to arbitrary code execution when the application was reachable over the network.
An attacker with network access to a publicly hosted D-Tale instance can exploit the endpoint to enable custom filters and subsequently execute malicious code on the underlying server. No authentication or user interaction is required, making the issue exploitable by any remote party that can reach the service.
The project’s security advisory GHSA-832w-fhmw-w4f4 and the corresponding patch at commit 1e26ed3 recommend upgrading to version 3.16.1, which hardens the update-settings endpoint to prevent changes to the enable_custom_filters flag. For earlier releases the sole documented workaround is to restrict D-Tale exposure to trusted users only.
The associated EPSS score has remained flat at 0.0659 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3447
Vulnerability details
D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the…
more
`update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Data Processing Libraries
- Risk Domain
- Not Applicable
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- D-Tale is a visualizer specifically for pandas data structures, and pandas is a core data processing library widely used in AI/ML workflows for data manipulation and preparation.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2024-55890 is a remote code execution vulnerability in the publicly hosted D-Tale web application via the update-settings endpoint, enabling exploitation of public-facing applications.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.