CVE-2026-104141

In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.

In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26.

In DataEase prior to 2.10.26, an authenticated user with folder creation permission can store HTML-bearing names. When another user opens the Move to dialog and types in its search box, attacker-controlled JavaScript executes in the victim's session (XSS).

A flaw was found in DataEase up to version 3.0.0 in the Utils.buildCalcField function of the file io/dataease/engine/utils/Utils.java. Manipulation of the calculated field argument causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A directory traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a crafted request to the StaticResourceController.java component.

A vulnerability was found in DataEase up to versions 2.10.25/2.10.26. It affects the buildTooltip function in symbolic-map.ts of the Symbolic Map component, where manipulation of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument leads to cross site scripting (XSS). The attack can be performed remotely, and the project was informed early via an issue report but has not responded.