Quick answers
- Is CVE-2026-55647 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55647 being exploited in the wild.
- How severe is CVE-2026-55647?
- Informational severity, with a CVSS score of 5.1, published 7 July 2026.
- Which products and versions are affected?
- DataEase < 2.10.24.
- Is there a fix for CVE-2026-55647?
- A patch was published on 2026-07-07: Fix released in version 2.10.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55647 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-55647?
- Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in DataEase dashboard text and scrolling-text components. The root cause is the use of Vue's 'v-html' directive to render 'propValue' content without server-side or client-side HTML sanitization. An authenticated attacker with dashboard editing privileges can inject malicious HTML payloads (e.g., using event handlers like 'onerror' or 'onload') into the component data. These payloads are persisted in the backend database and executed in the context of any user viewing the dashboard, including unauthenticated visitors using shared links. The issue is addressed in version 2.10.24 by implementing proper HTML sanitization before rendering.
Affected products
- DataEase DataEase < 2.10.24
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD
- 2026-07-07: patched: Fix released in version 2.10.24