ByteOS Network

CVE Vulnerability Details :

CVE-2026-27194

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-21 Feb, 2026 | 04:25

Updated At-21 Feb, 2026 | 04:25

▼CVE Numbering Authority (CNA)

D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. This issue has been fixed in version 3.20.0.

Affected Products

Vendor

man-group

Product

dtale

Versions

Affected

< 3.20.0

Problem Types

Type	CWE ID	Description
CWE	CWE-74	CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Type: CWE

CWE ID: CWE-74

Description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Metrics

Version	Base score	Base severity	Vector
4.0	8.1	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Version: 4.0

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

Hyperlink	Resource
https://github.com/man-group/dtale/security/advisories/GHSA-c87c-78rc-vmv2	x_refsource_CONFIRM
https://github.com/man-group/dtale/commit/431c6148d3c799de20e1dec86c4432f48e3d0746	x_refsource_MISC

Hyperlink: https://github.com/man-group/dtale/security/advisories/GHSA-c87c-78rc-vmv2

Resource:

x_refsource_CONFIRM

Hyperlink: https://github.com/man-group/dtale/commit/431c6148d3c799de20e1dec86c4432f48e3d0746

Resource:

x_refsource_MISC

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References