Is there a patch available for CVE-2026-55647?

Yes, a patch is available for CVE-2026-55647. Update the affected software to the latest version immediately.

DataEase CVE-2026-55647

Q: What is the CVSS score of CVE-2026-55647?

CVE-2026-55647 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42098 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-07 GitHub_M

XSS Dataease

5.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Editor-level authentication required (PR:L); victim must load the dashboard (UI:R); payload executes in victim's browser context causing scope change (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:48 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable event handlers that execute when another user or shared-link visitor views the dashboard. This issue is fixed in version 2.10.24.

AnalysisAI

Stored XSS in DataEase dashboard text components allows any authenticated user with edit access to inject HTML containing executable event handlers that fire silently in the browser of every subsequent dashboard viewer, including unauthenticated shared-link recipients. All versions prior to 2.10.24 are affected due to the use of Vue's v-html directive to render stored component content without server-side sanitization. No public exploit or active exploitation has been confirmed at time of analysis; a vendor-released patch is available in version 2.10.24.

Technical ContextAI

DataEase is a Vue.js-based open source data visualization platform. The vulnerability arises from use of Vue's v-html directive to render dashboard text component content directly into the DOM without prior server-side sanitization. Unlike Vue's standard template interpolation ({{ }}), v-html bypasses Vue's built-in XSS escaping and injects raw HTML, making it a well-documented XSS vector in Vue applications. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - attacker-controlled HTML strings containing event attributes (e.g., onerror, onclick, onmouseover) are stored as-is on the server and later rendered in any viewer's browser. The CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* confirms all DataEase versions across all platforms are affected prior to the fix.

RemediationAI

Upgrade DataEase to version 2.10.24 or later, which introduces server-side HTML sanitization for dashboard text components. The two fix commits are available at https://github.com/dataease/dataease/commit/9565812980da781eda04c0a3632bf5dc8b0469f6 and https://github.com/dataease/dataease/commit/adab5f1e8954ff91830a3b2f052a42a139d978e1. As compensating controls prior to patching: restrict dashboard edit permissions exclusively to fully trusted internal users, reducing the pool of potential injectors; and disable or revoke shared-link access to dashboards, which eliminates the unauthenticated victim exposure path. Note that restricting edit permissions does not remediate any malicious payloads already stored in existing dashboard components - a post-patch audit of existing dashboard text content is advisable to detect previously injected payloads.