CVE-2026-35052: D-Tale: Remote Code Execution through redis/shelf storage

April 3, 2026 (updated April 6, 2026)

Users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server.

References

github.com/advisories/GHSA-436g-fhfc-9g5w
github.com/man-group/dtale
github.com/man-group/dtale/security/advisories/GHSA-436g-fhfc-9g5w
nvd.nist.gov/vuln/detail/CVE-2026-35052

Code Behaviors & Features

Detect and mitigate CVE-2026-35052 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →