D-Tale Remote Code Execution Vulnerability

A remote code execution vulnerability exists in D-Tale versions prior to 3.20.0, specifically through the /save-column-filter endpoint. This issue allows attackers to execute arbitrary code on servers hosting D-Tale publicly.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where D-Tale is hosted.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the /save-column-filter endpoint with a column filter that includes malicious code, such as Python commands or references to local variables that can be exploited.

Remediation

Users should upgrade to D-Tale version 3.20.0, where this vulnerability has been patched.