DataEase EUVD-2026-42092

Exploitation requires an authenticated DataEase account (CVSS PR:L) with the ability to create or configure a datasource using an H2 JDBC connection string. The concrete prerequisite is the attacker-controlled H2 JDBC URL: they must supply a connection string embedding the INIT parameter, obfuscated with special Unicode characters whose case conversion differs between DataEase's validator and H2's parser, so the blocked 'init' keyword passes validation yet is honored by H2. Limiting factors: the target must run a version prior to 2.10.24, the H2 datasource type must be permitted, and the attacker must possess valid (even low-privileged) credentials with datasource-management rights - it is not exploitable by fully unauthenticated users, and no victim user interaction is required.

The vendor CVSS 4.0 score of 8.7 (High) reflects AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact on the vulnerable system and no scope change. Realistic risk is significant: exploitation is network-reachable, low-complexity, and needs no user interaction, but PR:L means the attacker must first hold a valid low-privileged DataEase account able to create or edit datasource connections - this is the main gating factor. There is no CISA KEV listing and no public POC identified, so this is not confirmed active exploitation; however, the fix commit is public, which lowers the barrier to weaponization. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. Overall this is a genuine priority for internet-exposed DataEase instances where accounts can be self-registered or are widely held, and a lower priority where datasource creation is tightly restricted to trusted admins.

A low-privileged DataEase user with access to datasource configuration crafts an H2 JDBC URL in which the 'init' keyword is written with special Unicode characters that survive DataEase's validation but are case-folded by H2 back into a functional INIT clause. When the connection is opened, H2 executes the attacker's SQL, which creates a Java alias to run OS commands, giving arbitrary code execution on the server. No public POC is currently identified, but the public fix commit reveals the vulnerable validation path.