Redis
CVE-2026-35052
MEDIUM
GHSA-436g-fhfc-9g5w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 12 pypi packages depend on dtale (12 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.22.0.
DescriptionGitHub Advisory
Impact
Users hosting D-Tale publicly while using a redis or shelf storage layer could be vulnerable to remote code execution allowing attackers to run malicious code on the server.
Patches
Users should upgrade to version 3.22.0.
Workarounds
There are no workarounds for versions < 3.22.0
AnalysisAI
Remote code execution in D-Tale allows unauthenticated attackers to execute arbitrary code on servers hosting D-Tale publicly when using Redis or Shelf storage backends. The vulnerability stems from improper input validation in the storage layer, affecting D-Tale versions prior to 3.22.0. Vendor-released patch version 3.22.0 is available.
Technical ContextAI
D-Tale is a Python data visualization and analysis library distributed via PyPI (pkg:pip/dtale). The vulnerability exists in the data storage abstraction layer, specifically when Redis or Shelf storage backends are configured for persistent data storage. The underlying flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which typically indicates cross-site scripting or injection vulnerabilities that can escalate to remote code execution depending on how user input is deserialized or evaluated by the backend storage system. When D-Tale is exposed publicly without authentication controls and uses these storage backends, attackers can inject malicious payloads that are executed server-side during deserialization or evaluation of cached/stored objects.
RemediationAI
Upgrade D-Tale to version 3.22.0 or later immediately using pip (pip install --upgrade dtale>=3.22.0). No workarounds exist for affected versions, so patching is mandatory. For detailed remediation guidance and acknowledgment of the vulnerability, refer to the official GitHub security advisory at https://github.com/man-group/dtale/security/advisories/GHSA-436g-fhfc-9g5w. If immediate patching is not possible, restrict network access to D-Tale instances to authorized users only and disable or relocate to non-public deployments until patching is completed.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today