Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/dataease/dataease/security/advisories/GHSA-rg6c-r9mv-39fr
X_Refsource_Misc x_refsource_misc
https://github.com/dataease/dataease/commit/f1c7204da1787ef812ee23cd3d51a1824126c1fb
X_Refsource_Misc x_refsource_misc
https://github.com/dataease/dataease/releases/tag/v2.10.23
Scores
CVSS v4
8.7
EPSS
0.0023
EPSS Percentile
13.5%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
dataease/dataease
< 2.10.23
Published
Jul 15, 2026
Tracked Since
Jul 16, 2026