Executive brief
DataEase, an open-source data visualization and analysis tool, is vulnerable to a security flaw in how it handles database connections. An attacker with low-level user privileges can execute unauthorized database commands by providing a specially crafted schema name when configuring a data source. This could allow an attacker to view, modify, or delete sensitive information stored in connected databases such as DB2, SQL Server, and PostgreSQL.
Technical details
A SQL injection vulnerability exists in DataEase prior to version 2.10.23 within the `io.dataease.datasource.provider.CalciteProvider#checkStatus` method. The application fails to sanitize the `configuration.getSchema()` input before concatenating it into the `getTablesSql` query, which is subsequently executed via `executeQuery`. The vulnerability can be exploited via two paths: a blind injection during data source validation or a direct injection where results are echoed back to the frontend when retrieving table lists. The flaw affects multiple database providers including DB2, SQL Server, and PostgreSQL. The fix, introduced in version 2.10.23, replaces vulnerable string concatenation and `Statement` execution with `PreparedStatement` and parameterized queries.
Affected products
- DataEase DataEase < 2.10.23
Timeline
- 2026-05-13: patched: Fix commit pushed to repository
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD