Cyber Posture

CVE-2026-27194

Critical

Published: 21 February 2026

Published
21 February 2026
Modified
23 February 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 34.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on…

more

the server. This issue has been fixed in version 3.20.0.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely remediation of known software flaws like this RCE vulnerability by applying the vendor patch in D-Tale version 3.20.0.

SI-10 Information Input Validation good match
prevent

Enforces validation of all information inputs to endpoints such as /save-column-filter, preventing improper neutralization that enables RCE.

SC-14 Public Access Protections good match
prevent

Provides protections for publicly accessible interfaces like the vulnerable D-Tale endpoint, rejecting unauthorized access or enforcing controls on public exposure.

Security SummaryAI

CVE-2026-27194 is a remote code execution vulnerability affecting D-Tale, a visualizer for pandas data structures, in versions prior to 3.20.0. The flaw exists in the /save-column-filter endpoint, which allows attackers to execute arbitrary code on the server. Published on 2026-02-21, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-74 (Improper Neutralization of Special Elements used in an SQL Command).

Any unauthenticated attacker with network access to a publicly hosted D-Tale instance can exploit this vulnerability without user interaction or privileges. Successful exploitation enables remote code execution, granting high-impact access to confidentiality, integrity, and availability on the affected server by running malicious code.

The issue has been addressed in D-Tale version 3.20.0. The GitHub security advisory (GHSA-c87c-78rc-vmv2) and fixing commit (431c6148d3c799de20e1dec86c4432f48e3d0746) detail the patch, recommending immediate upgrades for exposed deployments.

Details

CWE(s)
CWE-74

Affected Products

man
d-tale
≤ 3.19.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2026-27194 is a remote code execution vulnerability in a public-facing web application (D-Tale), directly enabling exploitation of public-facing applications via unauthenticated network access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References