D‑Tale, a visualizer for pandas data structures, is vulnerable to remote code execution through its /save-column-filter endpoint. An attacker who can reach this endpoint can send a crafted request that causes the server to execute arbitrary code. The weakness is a form of expression injection, as identified by CWE‑74, allowing execution of unexpected code paths and compromising confidentiality, integrity, and availability of the host system.

The vendor "man-group" provides the D‑Tale application. All releases before version 3.20.0 contain the vulnerability. The fix was introduced in 3.20.0; any deployment of earlier builds is at risk.

The CVSS score of 8.1 indicates a high‑severity flaw. The EPSS score is below 1 %, suggesting that an exploit is unlikely at this time, but the vulnerability is not part of the CISA KEV catalog and is still publicly disclosed. Attackers can potentially exploit the endpoint via the internet if the application is publicly reachable, making the remote attack vector plausible. No special network conditions beyond public access are required.