CVE-2026-104143 Details
Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.
A stored SQL injection vulnerability has been identified in DataEase versions prior to 2.10.26. Authenticated users can inject malicious SQL payloads into a dataset field's custom date format, which is then executed when the field is used in a chart. This vulnerability allows for arbitrary SQL execution on the backend database, potentially compromising the database's confidentiality, integrity, and availability.
Users are advised to upgrade to DataEase version 2.10.26, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dataease/dataease/commit/c8cde16056a9e46aa4866ded94db2b250758b337 | [email protected] | Source CodeVendor |
| https://github.com/dataease/dataease/releases/tag/v2.10.26 | [email protected] | Release NotesVendor |
| https://github.com/dataease/dataease/security/advisories/GHSA-h32f-m89w-g35f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-289 | Authentication Bypass by Alternate Name | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DataEase | < 2.10.26 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |