Executive brief
DataEase is an open-source data visualization and analysis platform used to create business dashboards. A security flaw allows attackers to bypass safety checks when connecting to H2 databases by using special characters that look different to the security filter than they do to the database engine. If exploited, an attacker can execute unauthorized commands on the server, potentially leading to a full system takeover, data theft, or service disruption.
Technical details
A remote code execution (RCE) vulnerability exists in DataEase due to flawed JDBC URL validation logic for H2 databases. The application attempts to blacklist dangerous parameters like 'init' by converting URLs to lowercase before inspection; however, it fails to account for Unicode case-conversion quirks (e.g., the character 'ı' vs 'i'). While the DataEase filter does not recognize the Unicode-altered string as a threat, the underlying H2 database engine parses these characters into dangerous keywords during connection initialization. An authenticated attacker with permissions to configure data sources can use a malicious JDBC string (e.g., using RUNSCRIPT) to achieve arbitrary code execution on the host. This issue is resolved in version 2.10.24 by implementing case-insensitive string comparisons that properly handle these Unicode variants.
Affected products
- DataEase DataEase < 2.10.24
Timeline
- 2026-06-18: patched: Fixed in version 2.10.24
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE-2026-53751 published to NVD