Is CVE-2026-55635 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55635 being exploited in the wild.

How severe is CVE-2026-55635?

Informational severity, with a CVSS score of 8.7, published 7 July 2026.

Is there a fix for CVE-2026-55635?

A patch was published on 2026-07-07: Fix released in version 2.10.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55635 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55635?

Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55635: DataEase SQL injection in chart quota and Y-axis filters

CVE-2026-55635 · Severity: info · CVSS 8.7 · Published 2026-07-07

DataEase is an open-source tool used by organizations to visualize and analyze business data. A security flaw in how the tool handles chart filters allows authorized users to inject malicious database commands. If exploited, an attacker could bypass security controls to view sensitive information, modify data, or disrupt database operations across connected data sources.

Technologies: DataEase. Vendors: DataEase.

Quick answers

Is CVE-2026-55635 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55635 being exploited in the wild.
How severe is CVE-2026-55635?: Informational severity, with a CVSS score of 8.7, published 7 July 2026.
Which products and versions are affected?: DataEase < 2.10.24.
Is there a fix for CVE-2026-55635?: A patch was published on 2026-07-07: Fix released in version 2.10.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55635 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55635?: Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated SQL injection vulnerability exists in DataEase due to improper neutralization of special elements in the Quota2SQLObj.getYWheres() method. Unlike other filter paths in the application, the quota and Y-axis filter path fails to invoke sanitizeSqlLiteral() or validateSqlInjectionRisk(), instead directly concatenating user-provided values from ChartViewFieldFilterDTO into SQL fragments (IN, LIKE, and default comparisons). An attacker with permissions to create or modify chart definitions can provide crafted filter values to execute arbitrary SQL queries against the underlying datasources. This can lead to unauthorized data exfiltration or modification depending on the privileges of the database connection. The issue is resolved in version 2.10.24 by implementing proper sanitization logic.

Affected products

DataEase DataEase < 2.10.24

Timeline

2026-06-18: advisory: GitHub Security Advisory published
2026-07-07: disclosed: CVE published to NVD
2026-07-07: patched: Fix released in version 2.10.24

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.