Which versions of DataEase are affected by CVE-2026-45535?

DataEase versions before 2.10.23 allow authenticated users to inject persistent SQL code through dataset configurations, exposing all dataset viewers to data theft and unauthorized modification.. A patch is available.

How to fix or mitigate CVE-2026-45535?

Within 24 hours, inventory all DataEase instances and confirm whether any run versions prior to 2.10.23. Within 7 days, restrict SQL-type dataset creation to trusted administrators, audit all existing SQL datasets for suspicious content, and enable database query logging. Within 30 days, contact the DataEase vendor for patch timeline or evaluate applying the publicly available upstream fix to your deployment.

DataEase CVE-2026-45535

Q: What is the CVSS score of CVE-2026-45535?

CVE-2026-45535 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44782 HIGH

SQL Injection (CWE-89)

2026-07-15 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable with low complexity but requires an authenticated dataset-authoring account (PR:L); injection allows reading and altering DB data (C:H/I:H) with limited availability impact (A:L), no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:05 vuln.today

Analysis Generated

Jul 15, 2026 - 20:05 vuln.today

CVE Published

Jul 15, 2026 - 19:39 cve.org

HIGH 8.7

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries such as ${var} and SqlparserUtils.handleVariableDefaultValue() inserts them with String.replace() without escaping or parameterization, causing stored SQL injection whenever a user with dataset read permission accesses the dataset. This issue is fixed in version 2.10.23.

AnalysisAI

Stored SQL injection in DataEase (open source data visualization/BI tool) versions prior to 2.10.23 allows an authenticated user who can define SQL-type datasets to persist malicious SQL through variable defaultValue entries, which later execute against the backend database whenever any user with dataset read permission opens the dataset. The flaw (CWE-89) enables reading and modifying arbitrary database data, and CVSS 4.0 rates it 8.7 (High). No public exploit has been identified at time of analysis, but the upstream fix commit is public, so exploitation prerequisites are well documented.

Technical ContextAI

DataEase is a Java/Spring backend BI platform whose SQL-type datasets support parameterized variables written as ${var} placeholders. The vulnerable routine SqlparserUtils.handleVariableDefaultValue() (and the parallel DeSqlparserUtils path) resolved a variable's stored defaultValue by directly concatenating it into the generated query with a String.replace() call, performing no escaping and no parameterization. Because the defaultValue is attacker-controllable dataset metadata and flows straight into a raw SQL string, this is a textbook CWE-89 (SQL Injection) caused by string-building instead of prepared statements. The fix introduces buildPreparedSqlFragmentForDefaultValue(), which wraps the default value into a SqlVariableDetails value list and routes it through buildPreparedSqlFragment() (the existing prepared-parameter path), and adds isQuotedVariable() handling to strip surrounding quotes so the value binds as a real parameter rather than inline text. Affected CPE is cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.23, which replaces raw defaultValue concatenation with prepared-parameter binding (fix commit 22930a493d900fe3d8084b3dd4c0125abdb2a847, release https://github.com/dataease/dataease/releases/tag/v2.10.23). Review the advisory at https://github.com/dataease/dataease/security/advisories/GHSA-pv23-p64m-4pxf for details. If immediate upgrade is not possible, reduce the population of accounts that can create or edit SQL-type datasets to a small set of trusted administrators (the exploit requires dataset-authoring privileges), and audit existing SQL datasets for suspicious ${var} default values before broad users open them - note this constrains legitimate self-service dataset creation. As a database-side compensating control, run DataEase's DB connection under a least-privilege account limited to the specific schemas it needs so that any injection cannot read or alter unrelated data; the trade-off is that overly tight grants may break legitimate cross-schema dataset queries. These are stopgaps only - upgrading to 2.10.23 is the reliable fix.