Read the docs
TI-2026-21631 Aliases CVE-2026-27194GHSA-c87c-78rc-vmv2

D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Priority LOW 39CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. This issue has been fixed in version 3.20.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00792 56th percentileScored 2026-11-07
Fix Fixed dtale (man-group): 3.20.0dtale (PyPI): 3.20.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
man-groupdtalebefore 3.20.03.20.0Patch availableCNA
—dtale (PyPI)before 3.20.03.20.0Patch availableGHSA-c87c-78rc-vmv2
  • dtale Vendorman-group Affected before 3.20.0 Fixed in 3.20.0 Patch available CNA
  • dtale (PyPI) Vendor— Affected before 3.20.0 Fixed in 3.20.0 Patch available GHSA-c87c-78rc-vmv2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:*up to 3.19.1Vulnerableman-group
  • cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:* Versions up to 3.19.1 Vulnerable ·man-group

Remediation

  • Fix · CNA dtale (man-group) Fixed in 3.20.0
  • Fix · GHSA-c87c-78rc-vmv2 dtale (PyPI) Fixed in 3.20.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27194
  2. 2026-10-03 Alias added: GHSA-c87c-78rc-vmv2

References

Patch 1

Advisory 2

Other 1

  • TI-2024-03179 Authentication Bypass and RCE in man-group/dtale CVSS 3.1CRITICAL 9.8
  • TI-2023-24776 D-Tale vulnerable to Remote Code Execution through the Custom Filter Input CVSS 3.1CRITICAL 9.8
  • TI-2024-30616 D-Tale allows Remote Code Execution through the Query input on Chart Builder CVSS 3.1CRITICAL 9.8
  • TI-2024-14367 D-Tale server-side request forgery through Web uploads CVSS 3.1HIGH 7.5
  • TI-2026-27255 D-Tale affected by Remote Code Execution through redis/shelf storage CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences