This vulnerability affects the build_secret_key function in the dtale/app.py file of mangroup dtale versions up to 3.22.0. The flaw causes insufficiently random values in the Flask Session Cookie, which could be exploited remotely. The attack complexity is rated high, indicating that exploitation requires significant effort or conditions. Although an exploit has been published, the pull request containing the fix is still awaiting acceptance, and no official patch or remediation level has been confirmed.

The vulnerability allows remote attackers to potentially exploit insufficient randomness in session cookie generation, which may weaken session security. However, the attack complexity is high and exploitability is difficult, limiting the likelihood of successful exploitation. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A pull request with a fix is pending acceptance. Until an official fix is released, users should monitor vendor communications for updates and consider risk mitigation strategies appropriate to their environment.