Which versions of DataEase are affected by CVE-2026-53751?

DataEase versions prior to 2.10.24 allow authenticated users to execute arbitrary code on the host through an H2 JDBC URL validation bypass exploiting Unicode character differences.. A patch is available.

How to fix or mitigate CVE-2026-53751?

Within 24 hours: Inventory all DataEase instances and verify current versions. Within 7 days: Upgrade all DataEase deployments to version 2.10.24 or later per vendor advisory. Within 30 days: Complete regression testing of upgraded systems, audit JDBC connection logs for anomalous activity, and review user access logs for the 30-day period prior to patching.

DataEase CVE-2026-53751

Q: What is the CVSS score of CVE-2026-53751?

CVE-2026-53751 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42092 HIGH

Code Injection (CWE-94)

2026-07-07 GitHub_M

RCE Code Injection Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable datasource feature with low complexity, but requires a valid low-privileged account holding datasource rights (PR:L); code execution yields full C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:22 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous parameters such as init in malicious H2 JDBC connection strings and achieve arbitrary code execution. This issue is fixed in version 2.10.24.

AnalysisAI

Arbitrary code execution in DataEase before 2.10.24 lets authenticated users bypass H2 JDBC URL validation using special Unicode characters whose case conversion differs between DataEase's validator and the H2 parser, smuggling dangerous parameters such as INIT into a malicious H2 connection string. Because H2's INIT clause executes SQL/DDL at connection time, an attacker can run arbitrary code on the host. No public exploit has been identified at time of analysis, but a fix commit and release exist, making the mechanism reproducible from the public patch.

Technical ContextAI

DataEase is an open-source business-intelligence and data-visualization platform (Java/Spring backend) that lets users configure external and embedded database connections. The vulnerability lives in the datasource layer, where users can supply H2 JDBC URLs. H2 is an embeddable Java SQL database whose JDBC URL supports an INIT clause that runs arbitrary SQL - including CREATE ALIAS ... AS a Java stored procedure - enabling command execution. The flaw is a classic parser-differential (CWE-94, Code Injection): DataEase validates the URL string one way while H2 parses it another. Specifically, certain Unicode characters case-fold differently across the two code paths, so a blocklisted keyword like 'init' can be encoded to pass DataEase's check yet be interpreted as INIT by H2. The affected component per CPE is cpe:2.3:a:dataease:dataease across all versions prior to 2.10.24.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.24 or later, which corrects the H2 JDBC URL validation so the case-conversion differential can no longer smuggle the INIT parameter (see the release at https://github.com/dataease/dataease/releases/tag/v2.10.24 and advisory GHSA-xjhm-r8p8-c2cg). If immediate upgrade is not possible, restrict who can create or edit datasource connections to trusted administrators only, and where feasible disallow H2 as a selectable datasource type since the INIT-clause abuse is specific to the embedded H2 driver - note this breaks any legitimate H2 usage. Additionally, keep DataEase behind authentication and network controls so datasource-management endpoints are not reachable by untrusted or self-registered accounts, and monitor for unexpected H2 JDBC URLs containing INIT or unusual Unicode characters. These compensating controls reduce exposure but do not fully close the parser-differential, so upgrading remains the only complete fix.