CVE-2026-27194: D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-21 · updated 2026-06-17
Weakness: CWE-74

Description

D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. This issue has been fixed in version 3.20.0.

Affected products

Man D-Tale: through 3.19.1

References

https://github.com/man-group/dtale/commit/431c6148d3c799de20e1dec86c4432f48e3d0746
https://github.com/man-group/dtale/security/advisories/GHSA-c87c-78rc-vmv2

Get alerted when CVE-2026-27194 or the next vulnerability affects your stack