CVE-2026-45417 Details
Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.
A SQL injection vulnerability has been identified in DataEase versions prior to 2.10.23. The issue arises in the datasource connection status checks, where user-controllable schema information is directly concatenated into SQL queries. This vulnerability affects DB2, SQL Server, PostgreSQL, and potentially other datasources that follow a similar SQL execution pattern. The injection occurs within the 'checkStatus' method of the 'CalciteProvider' class, allowing attackers to manipulate SQL queries and execute arbitrary SQL commands on the database.
Users are advised to upgrade to DataEase version 2.10.23 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dataease/dataease/security/advisories/GHSA-rg6c-r9mv-39fr | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/dataease/dataease/commit/f1c7204da1787ef812ee23cd3d51a1824126c1fb | [email protected] | Source CodeVendor |
| https://github.com/dataease/dataease/releases/tag/v2.10.23 | [email protected] | Release NotesVendor |
| https://github.com/dataease/dataease/security/advisories/GHSA-rg6c-r9mv-39fr | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DataEase | < 2.10.23 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |