Executive brief
DataEase is an open-source data visualization and analysis platform. A vulnerability in how the system handles SQL-type datasets allows users with dataset creation or editing permissions to inject malicious database commands. This could lead to the theft of sensitive information, including user credentials, password hashes, and system configuration keys, potentially compromising the entire data environment.
Technical details
A stored SQL injection vulnerability exists in DataEase versions prior to 2.10.23 within the SqlparserUtils.handleVariableDefaultValue() method. The root cause is the use of String.replace() to insert user-controlled 'defaultValue' entries into SQL templates without proper escaping or parameterization. An attacker with low-privileged access (permissions to create or edit datasets) can craft a malicious payload in the dataset variables. When any user with read access subsequently views the dataset, the injected SQL is executed. This can be exploited via error-based or time-based blind SQL injection to extract sensitive data from the backend database, including user hashes and system credentials. The issue is resolved in version 2.10.23 by implementing proper input neutralization.
Affected products
- DataEase DataEase < 2.10.23
Timeline
- 2026-05-28: patched: Fixed in version 2.10.23
- 2026-07-15: disclosed: Public advisory and CVE assignment