CVE-2026-35052 — D-Tale affected by Remote Code Execution through redis/shelf storage

CVE-2026-35052

D-Tale affected by Remote Code Execution through redis/shelf storage PUBLISHED

Description (CNA)

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server. This vulnerability is fixed in 3.22.0.

Affected (CNA)

Vendor / product	Versions
man-group / dtale	affected < 3.22.0

CWE

CWE-79

References

https://github.com/man-group/dtale/security/advisories/GHSA-436g-fhfc-9g5w

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.