D-Tale: Remote Code Execution through redis/shelf storage

CRITICAL 9.8CVE-2026-35052 · GHSA-436g-fhfc-9g5w · PYSEC-2026-2460 · Published 06/04/2026 · updated 23/10/2026

Package	Affected versions	Patched versions
dtale PyPI	`< 3.22.0`	`3.22.0`
d-tale man	`< 3.22.0`	`3.22.0`

Description

Impact

Users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server.

Patches

Users should upgrade to version 3.22.0.

Workarounds

There are no workarounds for versions < 3.22.0

NVD description

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server. This vulnerability is fixed in 3.22.0.

References

man-group/dtale security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-35052 · ADVISORY
man-group/dtale · PACKAGE
pypi.org/project/dtale · PACKAGE
GitHub Advisory GHSA-436g-fhfc-9g5w · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free