CVE-2023-46134 D-Tale vulnerable to Remote Code Execution through the Custom Filter Input

What is CVE-2023-46134?

CVE-2023-46134 is a medium-severity vulnerability in man-group dtale, published on 25 Oct 2023.

Official description

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in version 3.7.0 by turning off "Custom Filter" input by default. The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

Weakness: CWE-79

Which versions are affected by CVE-2023-46134?

3 open source packages ship an affected version, including dtale. It affects 1 product.

Products include Man D-Tale.

How do I fix CVE-2023-46134?

Upgrade dtale to 3.7.0 or later.

Is CVE-2023-46134 being exploited?

There is no known exploitation of CVE-2023-46134 in the wild and no public exploit code.

Other vulnerabilities in man-group dtale

• CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale Critical 9.8
• CVE-2026-27194 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint High 8.1
• CVE-2024-21642 D-Tale server-side request forgery through Web uploads High 7.5
• CVE-2024-45595 D-Tale allows Remote Code Execution through the Query input on Chart Builder Medium 6.1
• CVE-2026-35052 D-Tale affected by Remote Code Execution through redis/shelf storage Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jq6c-r9xf-qxjm, PYSEC-2026-1322.