Read the docs
TI-2026-27255 Aliases CVE-2026-35052GHSA-436g-fhfc-9g5w

D-Tale affected by Remote Code Execution through redis/shelf storage

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server. This vulnerability is fixed in 3.22.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00646 51st percentileScored 2026-11-07
Fix Fixed dtale (man-group): 3.22.0dtale (PyPI): 3.22.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
man-groupdtalebefore 3.22.03.22.0Patch availableCNA
—dtale (PyPI)before 3.22.03.22.0Patch availableGHSA-436g-fhfc-9g5w
  • dtale Vendorman-group Affected before 3.22.0 Fixed in 3.22.0 Patch available CNA
  • dtale (PyPI) Vendor— Affected before 3.22.0 Fixed in 3.22.0 Patch available GHSA-436g-fhfc-9g5w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:*before 3.22.0Vulnerableman-group
  • cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:* Versions before 3.22.0 Vulnerable ·man-group

Remediation

  • Fix · CNA dtale (man-group) Fixed in 3.22.0
  • Fix · GHSA-436g-fhfc-9g5w dtale (PyPI) Fixed in 3.22.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35052
  2. 2026-10-03 Alias added: GHSA-436g-fhfc-9g5w
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 1

  • TI-2024-03179 Authentication Bypass and RCE in man-group/dtale CVSS 3.1CRITICAL 9.8
  • TI-2023-24776 D-Tale vulnerable to Remote Code Execution through the Custom Filter Input CVSS 3.1CRITICAL 9.8
  • TI-2024-30616 D-Tale allows Remote Code Execution through the Query input on Chart Builder CVSS 3.1CRITICAL 9.8
  • TI-2026-21631 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint CVSS 4.0HIGH 8.1
  • TI-2024-14367 D-Tale server-side request forgery through Web uploads CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences