GHSA-gjxm-x497-4h6h

Source

https://github.com/advisories/GHSA-gjxm-x497-4h6h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-gjxm-x497-4h6h/GHSA-gjxm-x497-4h6h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gjxm-x497-4h6h

Aliases

CVE-2025-0655

Withdrawn

2025-04-15T21:45:58Z

Published

2025-03-20T12:32:52Z

Modified

2026-09-10T03:49:48Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Duplicate Advisory: D-Tale Command Injection vulnerability

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-832w-fhmw-w4f4. This link is maintained to preserve external references.

Original Description

A vulnerability in man-group/dtale versions 3.15.1 allows an attacker to override global state settings to enable the enable_custom_filters feature, which is typically restricted to trusted environments. Once enabled, the attacker can exploit the /test-filter endpoint to execute arbitrary system commands, leading to remote code execution (RCE). This issue is addressed in version 3.16.1.

Database specific

{
    "cwe_ids":  [
        "CWE-77",
        "CWE-78"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-21T23:49:58Z",
    "nvd_published_at":  "2025-03-20T10:15:53Z",
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / dtale

Package

Name: dtale; View open source insights on deps.dev
Purl: pkg:pypi/dtale

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.17.0

Affected versions

1.*

1.0.0

1.1.1

1.2.0

1.3.7

1.4.1

1.5.1

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6.10

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.7.10

1.7.11

1.7.12

1.7.13

1.7.14

1.7.15

1.8.0

1.8.1

1.8.3

1.8.4

1.8.6

1.8.7

1.8.8

1.8.9

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.8.18

1.8.19

1.9.0

1.9.1

1.9.2

1.10.0

1.11.0

1.12.1

1.13.0

1.14.1

1.15.2

1.16.0

1.17.0

1.18.2

1.19.2

1.20.0

1.21.1

1.22.0

1.22.1

1.23.0

1.24.0

1.25.0

1.26.0

1.27.0

1.28.0

1.28.1

1.29.0

1.29.1

1.30.0

1.31.0

1.32.0

1.32.1

1.33.0

1.33.1

1.34.0

1.35.0

1.36.0

1.37.0

1.37.1

1.38.0

1.39.0

1.40.0

1.40.1

1.40.2

1.41.0

1.41.1

1.42.0

1.42.1

1.43.0

1.44.0

1.44.1

1.45.0

1.46.0

1.47.0

1.48.0

1.49.0

1.50.0

1.50.1

1.51.0

1.52.0

1.53.0

1.54.0

1.54.1

1.55.0

1.56.0

1.57.0

1.58.1

1.58.2

1.58.3

1.59.0

1.59.1

1.60.1

1.60.2

1.61.0

1.61.1

2.*

2.0.0

2.1.0

2.1.2

2.2.0

2.3.0

2.4.0

2.5.1

2.6.0

2.7.1

2.8.0

2.8.1

2.9.0

2.9.1

2.10.0

2.11.0

2.12.0

2.12.1

2.12.2

2.12.3

2.13.0

2.14.0

2.14.1

2.15.0

2.15.2

2.16.0

3.*

3.0.0

3.1.0

3.1.6

3.1.7

3.2.0

3.3.0

3.4.0

3.5.0

3.6.0

3.7.0

3.8.0

3.8.1

3.9.0

3.10.0

3.11.0

3.12.0

3.13.0

3.13.1

3.14.0

3.14.1

3.15.0

3.15.1

3.16.0

3.16.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-gjxm-x497-4h6h/GHSA-gjxm-x497-4h6h.json"