Is CVE-2026-102756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102756 being exploited in the wild.

How severe is CVE-2026-102756?

Informational severity, published 14 October 2026.

Is there a fix for CVE-2026-102756?

Yes: fixed in 2.10.26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102756 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102756?

Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102756: DataEase stored XSS in chart axis label tooltip

CVE-2026-102756 · Severity: info · Published 2026-10-14

DataEase is an open-source data visualization and analysis platform used to create dashboards and reports. Authenticated users with dataset editing permissions can inject malicious HTML into chart labels, which gets rendered as executable JavaScript when other users view the dashboard and hover over truncated labels. An attacker can steal session tokens, modify dashboards, or access sensitive data visible to the victim.

Technologies: DataEase. Vendors: DataEase.

Quick answers

Is CVE-2026-102756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102756 being exploited in the wild.
How severe is CVE-2026-102756?: Informational severity, published 14 October 2026.
Which products and versions are affected?: DataEase before 2.10.26.
Is there a fix for CVE-2026-102756?: Yes: fixed in 2.10.26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102756 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102756?: Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.10.26

Technical details

Stored cross-site scripting (XSS) vulnerability in the axis label tooltip rendering function (configAxisLabelLengthLimit) in the chart component. When a dimension value containing HTML is stored in a bar-horizontal chart and truncated by lengthLimit, the full label is retrieved and injected directly into the g2-tooltip-title element via innerHTML without sanitization. Attack requires prior authentication and dataset editing capability; exploitation occurs when a victim hovers over the truncated label, executing attacker-controlled JavaScript in their session context.

Affected products

DataEase DataEase before 2.10.26

Timeline

2026-10-14: disclosed
2026-07-30: patched: v2.10.26 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.