Executive brief
DataEase is an open-source data visualization and dashboarding platform. A security vulnerability in the dashboard component allows an attacker to perform unauthorized database queries. This could lead to the exposure of sensitive business data or the modification of information within the database. An exploit for this issue has been made public.
Technical details
A SQL injection vulnerability exists in DataEase version 2.10.20 within the SqlparserUtils.transFilter function of the SqlparserUtils.java file. The flaw is located in the Data Dashboard component and stems from improper neutralization of special elements used in SQL commands (CWE-89). An attacker with high privileges can remotely exploit this vulnerability to execute arbitrary SQL queries against the backend database. A public exploit has been released, increasing the risk of exploitation. The vulnerability was disclosed on May 17, 2026.
Affected products
- DataEase DataEase 2.10.20
Timeline
- 2026-05-17: advisory: NVD publication date
- 2026-05-17: disclosed: Public disclosure of the vulnerability and exploit