{"id":"CVE-2026-27194","aliases":["GHSA-c87c-78rc-vmv2","PYSEC-2026-2461"],"title":"D-Tale affected by Remote Code Execution through the /save-column-filter endpoint","summary":"D-Tale affected by Remote Code Execution through the /save-column-filter endpoint","severity":"high","vendor":"dtale","product":"dtale","ecosystem":"pip","affected":["dtale < 3.20.0"],"patched":["dtale 3.20.0"],"published":"2026-02-19","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-c87c-78rc-vmv2","references":[{"url":"https://github.com/man-group/dtale/security/advisories/GHSA-c87c-78rc-vmv2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27194"},{"url":"https://github.com/man-group/dtale/commit/431c6148d3c799de20e1dec86c4432f48e3d0746"},{"url":"https://github.com/man-group/dtale"}],"tags":["osv","pip"],"epss":0.00962,"epssPercentile":0.59965,"ingestedAt":"2026-07-13T18:57:56.333Z","slug":"CVE-2026-27194","body":"## Overview\n\n### Impact\nUsers hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.\n\n### Patches\nUsers should upgrade to version 3.20.0.\n\n### Workarounds\nThere are no workarounds for versions < 3.20.0\n\n## Affected packages\n\n- `dtale < 3.20.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `dtale 3.20.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}