Read the docs
TI-2023-24776 Aliases CVE-2023-46134GHSA-jq6c-r9xf-qxjm

D-Tale vulnerable to Remote Code Execution through the Custom Filter Input

Priority MEDIUM 44CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in version 3.7.0 by turning off "Custom Filter" input by default. The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00856 58th percentileScored 2026-11-07
Fix Fixed dtale (man-group): 3.7.0dtale (PyPI): 3.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
man-groupdtalebefore 3.7.03.7.0Patch availableCNA
—dtale (PyPI)before 3.7.03.7.0Patch availableGHSA-jq6c-r9xf-qxjm
  • dtale Vendorman-group Affected before 3.7.0 Fixed in 3.7.0 Patch available CNA
  • dtale (PyPI) Vendor— Affected before 3.7.0 Fixed in 3.7.0 Patch available GHSA-jq6c-r9xf-qxjm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:*before 3.7.0Vulnerableman-group
  • cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:* Versions before 3.7.0 Vulnerable ·man-group

Remediation

  • Fix · CNA dtale (man-group) Fixed in 3.7.0
  • Fix · GHSA-jq6c-r9xf-qxjm dtale (PyPI) Fixed in 3.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46134
  2. 2026-10-03 Alias added: GHSA-jq6c-r9xf-qxjm

References

Patch 1

Advisory 2

Other 1

  • TI-2024-03179 Authentication Bypass and RCE in man-group/dtale CVSS 3.1CRITICAL 9.8
  • TI-2024-30616 D-Tale allows Remote Code Execution through the Query input on Chart Builder CVSS 3.1CRITICAL 9.8
  • TI-2026-21631 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint CVSS 4.0HIGH 8.1
  • TI-2024-14367 D-Tale server-side request forgery through Web uploads CVSS 3.1HIGH 7.5
  • TI-2026-27255 D-Tale affected by Remote Code Execution through redis/shelf storage CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences