CVE-2023-46134: dtale vulnerable to Remote Code Execution through the Custom Filter Input
Summary
CVE-2023-46134: dtale vulnerable to Remote Code Execution through the Custom Filter Input. Affects dtale versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dtale is a Python package available on PyPI that provides a web interface for exploring and analyzing data. It allows users to visualize and interact with data frames in a tabular format. The package is widely used for data analysis and visualization tasks. However, a vulnerability has been discovered in dtale versions prior to 3.7.0 that can lead to remote code execution through the Custom Filter input.
Vulnerability Detail
The vulnerability in dtale allows attackers to execute arbitrary code on the server hosting D-Tale. This can be exploited by malicious actors to run unauthorized commands and potentially gain control over the server. The vulnerability arises from the Custom Filter input, which is enabled by default in earlier versions of dtale. By crafting a malicious input, an attacker can inject and execute arbitrary code on the server. This poses a significant security risk to users hosting D-Tale publicly.
How To Fix
Latest published version: 3.22.0 as of 23 Oct 2026
pip install --upgrade "dtale==3.22.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.0
This is the first release that contains the fix.
pip install --upgrade "dtale==3.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users who are unable to upgrade to version 3.7.0, the only workaround is to restrict access to D-Tale and only host it for trusted users. By limiting access to trusted individuals, the risk of exploitation can be minimized. However, this is not a foolproof solution and upgrading to the latest version is strongly recommended.
Conclusion
The vulnerability in dtale versions prior to 3.7.0 can lead to remote code execution, allowing attackers to run malicious code on the server. Users are advised to upgrade to version 3.7.0 to mitigate the risk. Restricting access to trusted users can serve as a temporary workaround, but upgrading is the recommended solution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dtale →
FAQ
dtale is a Python package that provides a web interface for exploring and analyzing data frames. It allows users to visualize and interact with data in a tabular format.
The vulnerability allows remote code execution, enabling attackers to run malicious code on the server hosting D-Tale. This can lead to unauthorized access, data breaches, and potential control over the server.
To fix the vulnerability, upgrade to version 3.7.0 of dtale. This version disables the Custom Filter input by default, reducing the risk of remote code execution.
If you are unable to upgrade to version 3.7.0, restrict access to D-Tale and only host it for trusted users. However, upgrading to the latest version is strongly recommended.
You can find more information about the vulnerability in the dtale documentation and the associated GitHub advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for dtale.
