CVE-2026-35052: D-Tale Remote Code Execution Vulnerability
Summary
CVE-2026-35052: D-Tale: Remote Code Execution through redis/shelf storage. Affects dtale versions < 3.22.0. Fixed in 3.22.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
D-Tale is a powerful Python library that provides a web-based interface for analyzing and visualizing pandas data structures. It allows users to interact with their data in real-time, making it easier to explore and manipulate datasets. However, when hosted publicly with a redis or shelf storage layer, D-Tale becomes susceptible to a critical vulnerability that can lead to remote code execution.
Vulnerability Detail
The vulnerability arises from the way D-Tale handles data storage when using redis or shelf layers. Attackers can exploit this weakness to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or complete system compromise. This issue is particularly concerning for users who expose their D-Tale instances to the internet, as it allows malicious actors to run harmful scripts remotely.
How To Fix
Latest published version: 3.22.0 as of 23 Oct 2026
pip install --upgrade "dtale==3.22.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for versions prior to 3.22.0. Users are strongly advised to upgrade to the patched version to mitigate the risk.
Conclusion
In summary, the D-Tale package has a critical vulnerability that allows for remote code execution when using redis or shelf storage. Users must upgrade to version 3.22.0 to protect their systems from potential attacks. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain security.
See every vulnerability recorded for dtale →
FAQ
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary code on the server, leading to data breaches and unauthorized access.
The best course of action is to upgrade to version 3.22.0 or later, as there are no effective workarounds for earlier versions.
D-Tale is used for visualizing and analyzing pandas data structures through a web interface, making data manipulation more accessible.
Related vulnerabilities
Recent vulnerabilities recorded for dtale.
