# CVE-2026-8724: DataEase SQL injection in SqlparserUtils.transFilter

Source: https://junglewise.ai/threats/cve-2026-8724-dataease-sql-injection-in-sqlparserutils-transfilter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8724 · Severity: medium · CVSS 4.7 · Published 2026-05-17

DataEase is an open-source data visualization and dashboarding platform. A security vulnerability in the dashboard component allows an attacker to perform unauthorized database queries. This could lead to the exposure of sensitive business data or the modification of information within the database. An exploit for this issue has been made public.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-8724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8724 being exploited in the wild.

**How severe is CVE-2026-8724?** Medium severity, with a CVSS score of 4.7, published 17 May 2026.

**Which products and versions are affected?** DataEase 2.10.20.

**Is there a fix for CVE-2026-8724?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8724 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8724?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in DataEase version 2.10.20 within the SqlparserUtils.transFilter function of the SqlparserUtils.java file. The flaw is located in the Data Dashboard component and stems from improper neutralization of special elements used in SQL commands (CWE-89). An attacker with high privileges can remotely exploit this vulnerability to execute arbitrary SQL queries against the backend database. A public exploit has been released, increasing the risk of exploitation. The vulnerability was disclosed on May 17, 2026.

## Affected products

- DataEase DataEase 2.10.20

## Timeline

- 2026-05-17: advisory: NVD publication date
- 2026-05-17: disclosed: Public disclosure of the vulnerability and exploit

## References

- [https://github.com/xpp3901/CVE_APPLY/tree/main/V-D001_DataEase_SqlVariable_Injection](https://github.com/xpp3901/CVE_APPLY/tree/main/V-D001_DataEase_SqlVariable_Injection)
- [https://vuldb.com/submit/804256](https://vuldb.com/submit/804256)
- [https://vuldb.com/vuln/364315](https://vuldb.com/vuln/364315)
- [https://vuldb.com/vuln/364315/cti](https://vuldb.com/vuln/364315/cti)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)