Executive brief
DataEase is an open-source business intelligence and data visualization platform. An authenticated user with dashboard management permissions can inject malicious code into the tooltip background color field of a symbolic map chart. When another user views the same dashboard with read-only access, the injected code executes in their browser, potentially allowing account takeover, credential theft, or unauthorized data access.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the buildTooltip function of the symbolic map component (core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts). The root cause is that user-supplied tooltip backgroundColor is directly concatenated into a style.innerHTML string without sanitization. An attacker with dashboard "manage" permission can submit malicious HTML/CSS via POST /dataVisualization/updateCanvas to the canvasViewInfo customAttr.tooltip.backgroundColor field. The payload is stored in the database and later executed when read-only users load the chart. The attack requires the user to have already granted management permission on the target dashboard, but impacted users need only read-only access to trigger the vulnerability.
Affected products
- DataEase DataEase up to 2.10.25 and 2.10.26
Timeline
- 2026-08-01: disclosed: Issue reported to GitHub
- 2026-09-13: advisory: CVE-2026-90529 published