What is GHSA-436g-fhfc-9g5w?

GHSA-436g-fhfc-9g5w is a security advisory published by GitHub Security Advisories with Medium severity. D-Tale: Remote Code Execution through redis/shelf storage

Which CVE IDs does GHSA-436g-fhfc-9g5w cover?

GHSA-436g-fhfc-9g5w covers the following CVE IDs: CVE-2026-35052. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-436g-fhfc-9g5w?

GHSA-436g-fhfc-9g5w affects 1 product, including: pip/dtale:\u003c 3.22.0.

GHSA-436g-fhfc-9g5wMedium

D-Tale: Remote Code Execution through redis/shelf storage

Vendor

GitHub Security Advisories

Published

April 3, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-35052 →

📋 Description

Impact

Users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server.

Patches

Users should upgrade to version 3.22.0.

Workarounds

There are no workarounds for versions < 3.22.0

🎯 Affected products1

pip/dtale:< 3.22.0

🔗 References (3)

https://github.com/man-group/dtale/security/advisories/GHSA-436g-fhfc-9g5w
https://nvd.nist.gov/vuln/detail/CVE-2026-35052
https://github.com/advisories/GHSA-436g-fhfc-9g5w