8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27194

CVE-2026-27194: D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Impact

Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.

Patches

Users should upgrade to version 3.20.0.

Workarounds

There are no workarounds for versions < 3.20.0

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27194

CVE-2026-27194:

8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
dtale	pip	< 3.20.0	3.20.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a remote code execution flaw in D-Tale's column filtering mechanism, triggered via the /save-column-filter endpoint. This endpoint accepts user-defined filter configurations which are then used to construct query strings for the pandas.DataFrame.query() method. The query() method in pandas can be dangerous with untrusted input because it uses eval() internally, allowing for arbitrary Python code execution.

The vulnerable functions are the build_filter methods within various filter classes (StringFilter, NumericFilter, DateFilter, OutlierFilter) located in dtale/column_filters.py. These methods were responsible for taking user input from the filter configuration and constructing the query string. Prior to the patch, this was done without any sanitization or validation, allowing an attacker to inject malicious Python code into the query string. For example, an attacker could provide a filter value like __import__('os').system('cat /etc/passwd').

The function dtale.query.run_query acts as the execution sink where the crafted malicious query is passed to df.query(). The patch introduces a defense-in-depth validation layer (validate_query_safety) in this function to block dangerous queries before they are executed.

During exploitation, a runtime profiler would show calls to one of the build_filter methods, which process the malicious payload, followed by a call to run_query, which executes it.

Vulnerable functions

OutlierFilter.build_filter

dtale/column_filters.py

This function constructs a filter configuration from user input. The 'query' parameter from the configuration was used without validation, allowing an attacker to inject arbitrary code that would be executed by `pandas.DataFrame.query()`.

StringFilter.build_filter

dtale/column_filters.py

This function builds a query for string-based filters. User-controlled inputs like 'raw' and 'value' (from 'state') were used to construct a query string without sanitization, leading to potential code injection.

NumericFilter.build_filter

dtale/column_filters.py

This function creates queries for numeric filters. It directly used user-provided values ('value', 'min', 'max') in the query string construction. The patch added validation to ensure these values are numeric and do not contain malicious code.

DateFilter.build_filter

dtale/column_filters.py

This function builds a query for date-based filters. The 'start' and 'end' parameters from the user configuration were used without validation, allowing for code injection into the query string.

run_query

dtale/query.py

This function is the sink where the constructed query string is executed via `pandas.DataFrame.query()`. Before the patch, it would execute any query passed to it. The patch added a final validation step (`validate_query_safety`) as a defense-in-depth measure to block malicious queries before execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-27194: D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Impact

Patches

Workarounds

CVE-2026-27194:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-27194: D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Impact

Patches

Workarounds

Technical Details

8.1

8.1

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI