CVE-2026-27194 is a critical (CVSS 9.8) remote code execution flaw in D-Tale, the pandas visualizer, before version 3.20.0. The save-column-filter endpoint is the entry point. Anyone hosting D-Tale publicly can be exposed. Upgrade to 3.20.0 and take public instances offline until you do.
What's affected
D-Tale versions before 3.20.0. The record says users hosting D-Tale publicly are vulnerable to code running on the server. The fix is in 3.20.0.
How to check if you're exposed
pip show dtale
Compare the version with 3.20.0. Then look for running D-Tale servers, including ones data scientists start in notebooks and leave open on a shared host. Check whether any listens on a non local address.
What to do now
- Upgrade D-Tale to 3.20.0 or later.
- Find and stop D-Tale instances reachable from outside localhost, and put any that must stay behind authentication or a VPN.
- Review logs for requests to the save-column-filter endpoint.
- Check hosts that ran public instances for unexpected processes and files.
- Pin dtale in requirements files so older versions do not return.
Why it matters
The record lists CWE-74, injection. An endpoint that stores a column filter took input that ended up being evaluated as code. Data exploration tools are built for trusted local use and often skip the hardening a public web service needs.
The lesson is to treat analytics tools as services when they listen on a network. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a local only D-Tale affected?
The record points to public hosting as the risk. Local only use reduces exposure, but upgrade anyway.
Sources
- CVE-2026-27194 on Gold
- GitHub advisory listed in the record: https://github.com/man-group/dtale/security/advisories/GHSA-c87c-78rc-vmv2
- Fix commit listed in the record: https://github.com/man-group/dtale/commit/431c6148d3c799de20e1dec86c4432f48e3d0746
Last reviewed: 19 October 2026.
