dataease vulnerabilities
CVEs whose affected-version data names the dataease package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
8 CVEsRSS
CVE-2026-104143High· 8.7DataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date co…
CVE-2026-104142High· 8.7PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-fiel…
CVE-2026-104141High· 8.7PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, includin…
CVE-2026-102756Medium· 5.1PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLi…
CVE-2026-102755Medium· 5.1PoCDataEase is an open source data visualization and analysis tool
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and d…
CVE-2026-108824Medium· 6.3PoCA flaw has been found in DataEase up to 3.0.0
A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is poss…
CVE-2023-40772Medium· 4.3PoCA directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.
A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.
CVE-2026-90529Low· 3.5A vulnerability has been found in DataEase up to 2.10.25/2.10.26
A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic…