CVE-2026-35052CWE-79cross-site-scripting

CVE-2026-35052

Critical · published April 6, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to 3.22.0, users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server. This vulnerability is fixed in 3.22.0.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00860 · 58.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-06T22:16Z
Affected products (1)
ProductVersionsFixed in
man/d-tale< 3.22.03.22.0
References (1)
https://github.com/man-group/dtale/security/advisories/GHSA-436g-fhfc-9g5w · [email protected]
EPSS history
Timeline
  • 06 APR 17:32Z
    D-Tale affected by Remote Code Execution through redis/shelf storage
    cvelistv5