# CVE-2026-123990: DataEase SQL injection in chart data handler

Source: https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-123990 · Severity: high · CVSS 7.3 · Published 2026-11-07

DataEase is a data visualization and analytics platform that allows organizations to create dashboards and reports from multiple data sources. A SQL injection vulnerability in the chart data filtering component allows remote attackers to execute arbitrary SQL queries against the underlying database by manipulating filter operators, potentially leading to unauthorized data access or modification.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-123990 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123990 being exploited in the wild.

**How severe is CVE-2026-123990?** High severity, with a CVSS score of 7.3, published 7 November 2026.

**Which products and versions are affected?** DataEase up to 2.10.27 and 3.1.0.

**Is there a fix for CVE-2026-123990?** Yes: fixed in 3.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123990 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123990?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.2.0

## Technical details

The ExtWhere2Str.extWhere2sqlObj function in the Chart Data Handler component (engine/trans/ExtWhere2Str.java) concatenates user-supplied operator arguments directly into SQL queries without proper validation, enabling SQL injection attacks. An attacker can remotely exploit this vulnerability by crafting malicious filter operators in chart data requests. The fix implements validation of compound operators and replaces string concatenation with fixed AND/OR keywords.

## Affected products

- DataEase DataEase up to 2.10.27 and 3.1.0

## Timeline

- 2026-11-07: disclosed

## References

- [https://github.com/dataease/dataease/releases/tag/v3.2.0](https://github.com/dataease/dataease/releases/tag/v3.2.0)
- [https://vuldb.com/cve/CVE-2026-123990](https://vuldb.com/cve/CVE-2026-123990)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase SQL injection in calculated field expression](https://junglewise.ai/threats/cve-2026-108824-a-flaw-has-been-found-in-dataease-up-to-3-0-0-the-impacted)