{"id":"CVE-2024-8862","aliases":["GHSA-fg5m-m723-7mv6","PYSEC-2026-1321"],"url":"https://o3.security/vulnerability/CVE-2024-8862","summary":"h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization","details":"D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\\views.py, under the route @dtale.route(\"/chart-data/<data_id>\"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is `python`, which allows executing the query expression ans leading to a command execution vulnerability. ","published":"2024-09-14T19:31:04.957Z","modified":"2026-08-12T03:51:36.926241943Z","cvss":null,"epss":{"score":0.01328,"percentile":0.68402,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"dtale","fixedVersion":"3.14.1"}],"fix":{"url":"https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8","label":"man-group/dtale@b6e3096"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8862.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8862"},{"type":"ADVISORY","url":"https://vuldb.com/?id.277499"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.403200"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.277499"},{"type":"EVIDENCE","url":"https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Command-Execution-via-Panda-df-query-9dc40f0477ee4b65806de7921876c222?pvs=4"},{"type":"WEB","url":"https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8"},{"type":"PACKAGE","url":"https://github.com/man-group/dtale"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:36.926241943Z"}}