CVE-2023-46134

Medium

Published: 25 October 2023

Published

25 October 2023

Modified

21 November 2024

KEV Added

—

Patch

—

CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score 0.0218 84.7th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-46134 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Man D-Tale. Its CVSS base score is 6.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Data Processing Libraries; in the Other ATLAS/OWASP Terms risk domain; MITRE ATLAS techniques in scope: AI Supply Chain Compromise (AML.T0010), Exfiltration via AI Inference API (AML.T0024), External Harms (AML.T0048).

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-2766

Vulnerability details

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code…

on the server. This issue has been patched in version 3.7.0 by turning off "Custom Filter" input by default. The only workaround for versions earlier than 3.7.0 is to only host D-Tale to trusted users.

CWE(s): CWE-79 NVD-CWE-noinfo

AI Security AnalysisAI

AI Category: Data Processing Libraries
Risk Domain: Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: D-Tale is a tool for viewing and analyzing Pandas data structures, where Pandas is a core data processing library commonly used in AI/ML data workflows.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2023-46134 enables remote code execution on publicly hosted D-Tale servers via unsafe 'Custom Filter' input, directly facilitating exploitation of public-facing applications.