# CVE-2026-90529: DataEase cross-site scripting in symbolic map tooltip

Source: https://junglewise.ai/threats/cve-2026-90529-dataease-cross-site-scripting-in-symbolic-map-tooltip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90529 · Severity: low · CVSS 3.5 · Published 2026-09-13

DataEase is an open-source business intelligence and data visualization platform. An authenticated user with dashboard management permissions can inject malicious code into the tooltip background color field of a symbolic map chart. When another user views the same dashboard with read-only access, the injected code executes in their browser, potentially allowing account takeover, credential theft, or unauthorized data access.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-90529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90529 being exploited in the wild.

**How severe is CVE-2026-90529?** Low severity, with a CVSS score of 3.5, published 13 September 2026.

**Which products and versions are affected?** DataEase up to 2.10.25 and 2.10.26.

**Is there a fix for CVE-2026-90529?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90529 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90529?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the buildTooltip function of the symbolic map component (core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts). The root cause is that user-supplied tooltip backgroundColor is directly concatenated into a style.innerHTML string without sanitization. An attacker with dashboard "manage" permission can submit malicious HTML/CSS via POST /dataVisualization/updateCanvas to the canvasViewInfo customAttr.tooltip.backgroundColor field. The payload is stored in the database and later executed when read-only users load the chart. The attack requires the user to have already granted management permission on the target dashboard, but impacted users need only read-only access to trigger the vulnerability.

## Affected products

- DataEase DataEase up to 2.10.25 and 2.10.26

## Timeline

- 2026-08-01: disclosed: Issue reported to GitHub
- 2026-09-13: advisory: CVE-2026-90529 published

## References

- [https://github.com/dataease/dataease/](https://github.com/dataease/dataease/)
- [https://github.com/dataease/dataease/issues/18846](https://github.com/dataease/dataease/issues/18846)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)