CVE-2026-27194: 
Python vulnerability analysis and mitigation

CVE-2026-27194 is a Remote Code Execution (RCE) vulnerability in D-Tale, a web-based visualizer for pandas data structures. The flaw exists in the /save-column-filter endpoint, where user-supplied filter inputs are interpolated into query strings passed to pandas.DataFrame.query() without adequate sanitization, enabling arbitrary Python code execution. All versions prior to 3.20.0 (up to and including 3.19.1) are affected. The vulnerability was disclosed on February 18, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.1 (High) (Github Advisory, D-Tale Security Advisory).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74). Column filters in D-Tale construct query strings from user-supplied input that are passed directly to pandas.DataFrame.query(), which can evaluate arbitrary Python expressions. An unauthenticated remote attacker can craft a malicious filter payload — for example, embedding Python constructs such as __import__, exec(), eval(), or os.* calls — and submit it to the /save-column-filter endpoint to achieve server-side code execution. The fix introduced two layers of validation: per-filter-type input validation (blocking dangerous patterns in String, Numeric, Date, and Outlier filters) and a defense-in-depth validate_query_safety() check in run_query() that intercepts dangerous patterns immediately before DataFrame.query() is invoked (Patch Commit, Github Advisory).

Successful exploitation grants an unauthenticated attacker full arbitrary code execution on the server hosting D-Tale, with the privileges of the process running the application. This results in complete compromise of confidentiality (access to all data accessible by the server process, including pandas DataFrames and underlying file system), integrity (ability to modify or delete data and server files), and availability (ability to crash or disrupt the service). Attackers could also use the compromised server as a pivot point for lateral movement within internal networks, making publicly hosted D-Tale instances particularly high-risk targets (Github Advisory, D-Tale Security Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and no special preconditions beyond network access to a publicly exposed D-Tale instance, making it trivially exploitable if a PoC were to emerge. The EPSS score is approximately 0.38% (0.00378), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Github Advisory, Feedly).

1. Reconnaissance: Identify publicly accessible D-Tale instances using search engines (e.g., Shodan, Censys) or by scanning for the default D-Tale web interface port. Confirm the version is prior to 3.20.0 by inspecting HTTP response headers or the UI.
2. Identify the vulnerable endpoint: Target the /save-column-filter HTTP endpoint, which accepts filter configuration data for pandas DataFrame columns.
3. Craft a malicious payload: Construct a filter value that embeds a dangerous Python expression exploitable via pandas.DataFrame.query(). For example, inject a payload containing __import__('os').system('id') or similar constructs within a filter field (e.g., a string or numeric filter value).
4. Submit the request: Send an HTTP POST request to /save-column-filter with the crafted payload. No authentication token or session cookie is required for publicly hosted instances.
5. Achieve code execution: The server interpolates the malicious input into a query string and passes it to DataFrame.query(), which evaluates the embedded Python expression, executing arbitrary commands as the D-Tale server process user.
6. Post-exploitation: Use the code execution primitive to establish a reverse shell, exfiltrate data, or pivot to other internal systems (Patch Commit, Github Advisory).

• Network: Unexpected or anomalous HTTP POST requests to the /save-column-filter endpoint containing Python-like expressions (e.g., __import__, exec, eval, os.system) in filter parameter values; outbound connections from the D-Tale server process to unknown external IPs or C2 infrastructure.
• Logs: Web server or application logs showing POST requests to /save-column-filter with encoded or obfuscated payloads; Python tracebacks or errors in D-Tale logs related to DataFrame.query() evaluation failures triggered by malformed inputs.
• Process: Unusual child processes spawned by the Python/D-Tale process (e.g., sh, bash, curl, wget, python -c) that are not part of normal D-Tale operation; unexpected network connections initiated by the D-Tale process.
• File System: New or modified files in the D-Tale working directory or system temp directories (e.g., web shells, scripts, or downloaded binaries); new cron jobs or scheduled tasks created under the D-Tale service account.

The primary remediation is to upgrade D-Tale to version 3.20.0 or later, which introduces input validation at both the filter level and the query execution level to block dangerous patterns. The vendor has confirmed there are no workarounds available for versions prior to 3.20.0. As interim mitigations for organizations unable to patch immediately: restrict network access to D-Tale instances to trusted internal networks only, block external access to the /save-column-filter endpoint via a web application firewall or reverse proxy, and monitor for suspicious activity targeting this endpoint (Github Advisory, D-Tale Security Advisory).

The vulnerability was published by D-Tale maintainer aschonfeld on February 18, 2026, with a prompt patch released in version 3.20.0. A post on Bluesky by TheHackerWire noted the disclosure shortly after publication. No significant broader media coverage or notable independent researcher commentary has been identified beyond standard vulnerability database aggregation (Feedly).