CVE-2026-102755 Details
Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue read the stored name from a node title attribute and assign search-highlighted content to innerHTML. When another user opens a Move to dialog and types in its search box, attacker-controlled JavaScript can execute in the victim's DataEase session. This issue is fixed in version 2.10.26.
A stored cross-site scripting vulnerability has been identified in DataEase versions prior to 2.10.26. This issue allows authenticated users with folder creation permissions to inject HTML into folder names. The vulnerability arises in the 'Move to' dialog for both datasources and datasets, where the injected HTML is executed as JavaScript in the context of the user's session. The flaw is rooted in the improper handling of user-controlled data, which is later rendered as HTML without adequate sanitization.
Users are advised to upgrade to DataEase version 2.10.26, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dataease/dataease/security/advisories/GHSA-pjh9-r96g-pcqw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/dataease/dataease/commit/f9082e2fa7a3d289115ae6f4a20ca58afd001be3 | [email protected] | Source CodeVendor |
| https://github.com/dataease/dataease/releases/tag/v2.10.26 | [email protected] | Release NotesVendor |
| https://github.com/dataease/dataease/security/advisories/GHSA-pjh9-r96g-pcqw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DataEase | < 2.10.26 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |