CVE Intelligence
Analysis AI-assisted

CVE-2026-27194: D-Tale Remote Code Execution via /save-column-filter endpoint

D-Tale, a visualizer for pandas data structures, has a remote code execution flaw reachable through the /save-column-filter endpoint in versions before 3.20.0. NVD rates the issue critical with a score of 9.8, and the record states it is fixed in 3.20.0. The record does not show this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

D-Tale is a visualizer for pandas data structures. According to the record, versions before 3.20.0 are vulnerable to remote code execution through the /save-column-filter endpoint, and the issue is fixed in 3.20.0. The weakness is classified as CWE-74 (Injection).

Impact

The record states that users hosting D-Tale publicly can be exposed to remote code execution, which would allow an attacker to run malicious code on the server. NVD scores the issue 9.8 (critical), with high confidentiality, integrity and availability impact. GitHub as a CNA scores it 8.1 under a different CVSS scoring revision. Both scores are reported in the record and reflect each provider's assessment.

Affected products and versions

  • Man D-tale: versions up to and including 3.19.1.
  • Man-group Dtale: versions before 3.20.0.
  • Fixed version according to the record: 3.20.0.

The record lists two product entries with different spellings. Both describe the same fixed boundary at 3.20.0.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record indicates exploitation as none and automatable as no. The FIRST EPSS probability in the record is 0.01075 with a percentile of 0.64711.

Remediation and mitigation

  • Upgrade D-Tale to version 3.20.0 or later, using the maintainers' fix referenced in the record.
  • Read the maintainers' advisory GHSA-c87c-78rc-vmv2 for their guidance on the issue.
  • Until patching is complete, do not expose D-Tale instances to untrusted networks. Restrict access to trusted users and place instances behind authentication and network controls.
  • Treat any instance that is publicly reachable and running a version before 3.20.0 as a priority for remediation.

Detection guidance

  • Inventory every D-Tale installation, including those deployed in notebooks, containers or internal services, and record the installed version of each.
  • Review web server and application logs for unusual or unexpected requests to the /save-column-filter endpoint, especially from unknown sources.
  • Monitor hosts running D-Tale for unexpected child processes, new files or outbound connections originating from the service account.

Limitations of the available information

  • The record does not describe the exact request conditions for the endpoint or the internal mechanism of the flaw.
  • The CVSS vector indicates no privileges required and no user interaction, but the record does not explain any further deployment preconditions.
  • The record does not reference any public proof of concept or exploitation evidence. This absence does not prove that exploitation has not occurred.
  • The record does not list any version ranges beyond the two endpoints shown in the affected product entries.

Frequently asked questions

Which D-Tale versions are affected by CVE-2026-27194?

According to the record, versions before 3.20.0 are affected. One product entry lists versions up to and including 3.19.1, and the other lists versions before 3.20.0.

Is this vulnerability being actively exploited?

The record does not list CVE-2026-27194 in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it as a priority if they run affected versions on public networks.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.