A flaw in D‑Tale versions prior to 3.22.0 enables attackers who can reach the publicly exposed Flask backend while a redis or shelf storage layer is in use to execute arbitrary code on the host. The vulnerability is provisioned through improperly handled data stored in redis or shelf, effectively allowing remote code execution. The input lists CWE‑79 and NVD-CWE-noinfo; the description indicates a severe execution flaw rather than a rendering issue.

The affected product is the D‑Tale framework developed by man‑group. Any installation of D‑Tale running a version older than 3.22.0 that uses redis or shelf for storage and is exposed to external traffic is vulnerable. No specific vendor versions beyond the major release boundary are listed, so all pre‑3.22.0 releases that meet these conditions are included.

The CVSS score of 5.3 classifies the vulnerability as medium severity, yet the impact of remote code execution remains high. Exploitation requires that the target be publicly reachable and that the attacker can influence input stored via redis or shelf. The EPSS score is reported as less than 1%, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation yet. The attack vector is inferred to be remote, network‑based against the web interface.