man-group/dtale · Security
D-Tale affected by Remote Code Execution through the /save-column-filter endpoint
- GHSA ID
- GHSA-c87c-78rc-vmv2
- CVE ID
- CVE-2026-27194
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Description
Impact
Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.
Patches
Users should upgrade to version 3.20.0.
Workarounds
There are no workarounds for versions < 3.20.0
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')