CVE-2026-35052 D-Tale affected by Remote Code Execution through redis/shelf storage

Medium 5.3 Published 6 Apr 2026 Updated 7 Apr 2026

Attackers can execute arbitrary code on D-Tale servers using redis or shelf storage, requiring a version upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-35052?

CVE-2026-35052 is a medium-severity code injection vulnerability in man-group dtale, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server. This vulnerability is fixed in 3.22.0.

Weakness: CWE-79

Which versions are affected by CVE-2026-35052?

3 open source packages ship an affected version, including dtale. It affects 1 product.

Package	Affected	Fixed in
`dtale` PyPI	All versions	`3.22.0`
`dtale` PyPI	All versions	`3.22.0`
`dtale` PyPI	All versions	`3.22.0`

Products include Man D-Tale.

How do I fix CVE-2026-35052?

Upgrade dtale to 3.22.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-35052 being exploited?

There is no known exploitation of CVE-2026-35052 in the wild and no public exploit code.

Sources

Also known as GHSA-436g-fhfc-9g5w, PYSEC-2026-2460.