GitHub Advisoryadvisory · PyPI

GHSA-c87c-78rc-vmv2 D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

HIGH Published 2026-02-19 Modified 2026-02-23 Official page ↗
Aliases
CVE-2026-27194
Ecosystem
PyPI
Packages
dtale
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-74
Reviewed
2026-02-19

Affected packages

• PyPI dtale: < 3.20.0 → fixed in 3.20.0

Description

Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.20.0. Workarounds There are no workarounds for versions < 3.20.0

Related

Alias · CVE (1)

  • CVE-2026-27194 D-Tale is a visualizer for pandas data structures. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References