# CVE-2026-55647: DataEase stored XSS in dashboard text components

Source: https://junglewise.ai/threats/cve-2026-55647-dataease-stored-xss-in-dashboard-text-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-55647 · Severity: info · CVSS 5.1 · Published 2026-07-07

DataEase is an open-source tool used for data visualization and business intelligence dashboards. A security flaw allows users with dashboard editing permissions to embed malicious code into text components. When other staff members or external visitors view the affected dashboard, this code executes in their browser, potentially allowing an attacker to steal session information or perform actions on behalf of the victim.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-55647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55647 being exploited in the wild.

**How severe is CVE-2026-55647?** Informational severity, with a CVSS score of 5.1, published 7 July 2026.

**Which products and versions are affected?** DataEase < 2.10.24.

**Is there a fix for CVE-2026-55647?** A patch was published on 2026-07-07: Fix released in version 2.10.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55647 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55647?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in DataEase dashboard text and scrolling-text components. The root cause is the use of Vue's 'v-html' directive to render 'propValue' content without server-side or client-side HTML sanitization. An authenticated attacker with dashboard editing privileges can inject malicious HTML payloads (e.g., using event handlers like 'onerror' or 'onload') into the component data. These payloads are persisted in the backend database and executed in the context of any user viewing the dashboard, including unauthenticated visitors using shared links. The issue is addressed in version 2.10.24 by implementing proper HTML sanitization before rendering.

## Affected products

- DataEase DataEase < 2.10.24

## Timeline

- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD
- 2026-07-07: patched: Fix released in version 2.10.24

## References

- [https://github.com/dataease/dataease/commit/9565812980da781eda04c0a3632bf5dc8b0469f6](https://github.com/dataease/dataease/commit/9565812980da781eda04c0a3632bf5dc8b0469f6)
- [https://github.com/dataease/dataease/commit/adab5f1e8954ff91830a3b2f052a42a139d978e1](https://github.com/dataease/dataease/commit/adab5f1e8954ff91830a3b2f052a42a139d978e1)
- [https://github.com/dataease/dataease/security/advisories/GHSA-4v63-24fg-pfg7](https://github.com/dataease/dataease/security/advisories/GHSA-4v63-24fg-pfg7)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)