CVE-2026-27194
Critical · 9.8CVSS
9.8
EPSS
1.1%
Published
Feb 21, 2026
CISA due date
—
The record
D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. This issue has been fixed in version 3.20.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | dtale | 0 | 3.20.0 |
Related vulnerabilities
- GHSA-c87c-78rc-vmv2 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint Same vulnerability
- CVE-2024-3408 man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code… Also affects dtale
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-74
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-74
- CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to… CWE-74
- CVE-2026-112141 A vulnerability was determined in satya-vinay Events-Management-System up to… CWE-74
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-74
- CVE-2026-112087 A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. CWE-74