CVE-2025-64428

Critical

Published: 20/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

Risk Assessment

JNDI injection could allow remote code execution and compromise of the Dataease server.

Recommendation

Upgrade Dataease to version 2.10.17 or later as soon as possible.

Original NVD description (English source)

Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.