DataEase CVE-2026-102756

Exploitation requires an authenticated DataEase account with privileges to edit dataset fields and chart configuration (PR:L), used to store an HTML-bearing dimension value in a bar-horizontal chart whose category-axis label is long enough that the lengthLimit feature truncates it - truncation is what triggers the vulnerable configAxisLabelLengthLimit code path in common_antv.ts that writes the full label to g2-tooltip-title via innerHTML. Execution is further gated by required victim interaction: a victim must open the affected dashboard and hover the truncated label (UI:P). Limiting factors: attacker must already be a trusted/authenticated editor (not anonymous), the chart must use the bar-horizontal type with axis-label length limiting active, the label must actually be truncated, and a victim must manually hover - reducing realistic exploitation to insider or compromised-account scenarios on versions prior to 2.10.26.

This is a medium-severity stored XSS (CWE-79) whose real-world risk is meaningfully constrained by its prerequisites, consistent with the vendor's CVSS 4.0 base score of 5.1. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) shows the attacker must already be an authenticated user with privileges to edit dataset fields and chart configuration (PR:L), and successful execution additionally depends on victim interaction (UI:P) - a victim must open the dashboard and hover the specific truncated category-axis label. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so widespread-exploitation probability cannot be quantified here. The impact is partial across confidentiality and integrity (VC:L/VI:L) with a subsequent-system/scope effect (SC:L/SI:L) reflecting that injected JavaScript runs in the victim's authenticated DataEase session rather than the attacker's, but availability is unaffected (VA:N). Net: this is a legitimate but lower-priority issue - it requires an already-trusted insider (or a compromised editor account) plus victim interaction, making it closer to a privilege-escalation/session-hijack risk within DataEase than a mass-exploitable remote flaw. The signals are internally consistent; no contradictions between the CVSS vector and the description were found.

A low-privileged but authenticated DataEase user with dataset-field and chart-edit rights stores a malicious HTML/JavaScript payload as a dimension value in a bar-horizontal chart, crafted so the category-axis label is long enough to be truncated by lengthLimit. When a higher-privileged victim later opens the dashboard and hovers over the truncated label, the full label is injected via innerHTML into the g2-tooltip-title element and the attacker's JavaScript executes in the victim's session. No public exploit code was identified, so weaponization would require the attacker to build the payload from the described code path.