PyPIPackage

dtale

8 known vulnerabilities (1 critical, 2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: 3.22.0 (Apr 1, 2026): no advisory with comparable ranges affects it; 1 advisory (CVE-2024-3408) can't be checked against versions
Newest unaffected release: 3.22.0 (Apr 1, 2026), the latest release, not counting 1 advisory without comparable ranges
Advisories: 8 · 1 critical, 2 high, 5 medium

Weekly downloads: 8,057
Dependents: 11
Releases: 177+ since 1.0.0 (Sep 7, 2019)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-35052
Affects 1.0.0 to 3.21.0 (3.22.0 is outside it)
CVE-2026-27194
Affects 1.0.0 to 3.19.1 (3.20.0 is outside it)
CVE-2024-55890
Affects 1.0.0 to 3.16.0 (3.16.1 is outside it)
CVE-2024-8862
Affects 1.0.0 to 3.14.0 (3.14.1 is outside it)
CVE-2024-45595
Affects 1.0.0 to 3.14.0 (3.14.1 is outside it)
CVE-2024-3408
Its ranges can't be placed on these versions
Its ranges can't be placed on these versions
CVE-2024-21642
Affects 1.0.0 to 3.8.1 (3.9.0 is outside it)
CVE-2023-46134
Affects 1.0.0 to 3.6.0 (3.7.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 8

CVE-2026-35052Medium 5.3
D-Tale affected by Remote Code Execution through redis/shelf storage
Affected: fixed in 3.22.0.
Fixed in 3.22.0 (released Apr 1, 2026, 5 days before disclosure).
The latest release, 3.22.0, is not affected.
CVE-2026-27194High 8.1
D-Tale affected by Remote Code Execution through the /save-column-filter endpoint
Affected: fixed in 3.20.0.
Fixed in 3.20.0 (released Feb 18, 2026, 3 days before disclosure).
The latest release, 3.22.0, is not affected.
CVE-2024-55890Medium 6.9
D-Tale allows Remote Code Execution through the Custom Filter Input
Affected: fixed in 3.16.1.
Fixed in 3.16.1 (released Dec 13, 2024, the day of disclosure).
The latest release, 3.22.0, is not affected.
CVE-2024-8862Medium 6.9
h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization
Affected: fixed in 3.14.1.
Fixed in 3.14.1 (released Sep 10, 2024, 4 days before disclosure).
The latest release, 3.22.0, is not affected.
CVE-2024-45595Medium 6.1
D-Tale allows Remote Code Execution through the Query input on Chart Builder
Affected: fixed in 3.14.1.
Fixed in 3.14.1 (released Sep 10, 2024, the day of disclosure).
The latest release, 3.22.0, is not affected.
CVE-2024-3408Critical 9.8
Authentication Bypass and RCE in man-group/dtale
Affected: all versions; through 3.10.0.
CVE-2024-21642High 7.5
D-Tale server-side request forgery through Web uploads
Affected: fixed in 3.9.0.
Fixed in 3.9.0 (released Jan 5, 2024, the day of disclosure).
The latest release, 3.22.0, is not affected.
CVE-2023-46134Medium 6.1
D-Tale vulnerable to Remote Code Execution through the Custom Filter Input
Affected: fixed in 3.7.0.
Fixed in 3.7.0 (released Oct 2, 2023, 23 days before disclosure).
The latest release, 3.22.0, is not affected.