CVE-2023-46134

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in version 3.7.0 by turning off "Custom Filter" input by default. The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-461357.5rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.CVE-2023-461367.5Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8,CVE-2023-461375.3Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP p CVE-2023-461385.3JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0 CVE-2023-461395.7KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device i CVE-2023-46149.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not re CVE-2023-461419.8Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote CVE-2023-461428.8A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to g CVE-2023-461437.5Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to mod CVE-2023-461446.5A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise int CVE-2023-461458.8Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a CVE-2023-461468.8Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.