---
id: CVE-2023-46134
aliases:
  - GHSA-jq6c-r9xf-qxjm
  - PYSEC-2026-1322
title: dtale vulnerable to Remote Code Execution through the Custom Filter Input
summary: dtale vulnerable to Remote Code Execution through the Custom Filter Input
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: dtale
product: dtale
ecosystem: pip
affected:
  - dtale < 3.7.0
patched:
  - dtale 3.7.0
published: '2023-10-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:58.678784516Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-jq6c-r9xf-qxjm'
references:
  - url: 'https://github.com/man-group/dtale/security/advisories/GHSA-jq6c-r9xf-qxjm'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-46134'
  - url: >-
      https://github.com/man-group/dtale/commit/bf8c54ab2490803f45f0652a9a0e221a94d39668
  - url: 'https://github.com/man-group/dtale'
tags:
  - osv
  - pip
epss: 0.00756
epssPercentile: 0.53175
ingestedAt: '2026-07-08T18:25:50.856Z'
---

## Overview

### Impact
Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

### Patches
Users should upgrade to version 3.7.0 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back on [here](https://github.com/man-group/dtale#custom-filter)

### Workarounds
The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

### References
See "Custom Filter" [documentation](https://github.com/man-group/dtale#custom-filter)


## Affected packages

- `dtale < 3.7.0`

## Remediation

Upgrade to a patched release:

- `dtale 3.7.0`