DataEase EUVD-2026-101560

Exploitation requires an authenticated account with folder-creation permission to store an HTML-bearing name through the datasource/createFolder or datasetTree/save endpoints (PR:L). It is further gated by victim interaction (UI:P): a second user must open a datasource or dataset 'Move to' dialog and type into its search box, which triggers the vulnerable search-highlight code path in CreatDsGroup.vue that assigns the stored title to innerHTML. It does not fire on default page loads and does not affect versions 2.10.26 or later where the sink was replaced with safe segment rendering. These factors - required authentication, required folder-creation privilege, and required victim search interaction - meaningfully limit real-world exploitation despite the network attack vector.

This is a stored/DOM cross-site scripting flaw (CWE-79) in DataEase rated CVSS 5.1 (medium) via the vendor-supplied CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. The signals are internally consistent and point to a real-but-contained issue rather than a drop-everything priority: network attack vector and low complexity ease delivery, but PR:L means the attacker must already be an authenticated user holding folder-creation permission, and UI:P means a second (victim) user must actively open a 'Move to' dialog and type into its search box before the payload fires - exploitation is not self-triggering. The confirmed root cause is corroborated by the vendor's GitHub Security Advisory (GHSA-pjh9-r96g-pcqw) and the fix commit, which shows the vulnerable ele.innerHTML = content.replace(...) sink being replaced with a safe segment-based template. No EPSS score was supplied, this CVE is not in CISA KEV, and no public exploit code was provided (the GitHub link is the patch diff, not a weaponized POC) - so there is no public exploit identified at time of analysis. Impact is limited to low confidentiality/integrity in the victim's authenticated DataEase session (session/token theft, actions as the victim), with no availability impact. Net: a legitimate stored-XSS bug worth patching, but the combination of required authentication, required victim interaction, and absence of KEV/POC/EPSS evidence makes it a moderate, insider-leaning risk rather than a widely-exploitable critical one.

An authenticated low-privileged user with folder-creation rights creates a datasource or dataset folder whose name contains an HTML/JavaScript payload via datasource/createFolder or datasetTree/save. Later, when a higher-privileged user opens a 'Move to' dialog and types into the search box, the stored name is reflected into innerHTML with search highlighting and the attacker's script executes in the victim's DataEase session, enabling session hijacking or actions performed as the victim. No public exploit code exists, but the patch commit clearly documents the vulnerable innerHTML sink.