DataEase EUVD-2026-42096

Requires an authenticated DataEase account (PR:L) with the ability to create or modify chart definitions, or to submit chart data requests that include quota (aggregation) filters or Y-axis filters - that specific capability IS the precondition. The payload must be delivered through the quota/Y-axis filter value processed by Quota2SQLObj.getYWheres(); other filter paths are not affected because they apply proper escaping. Exploitation is further gated by the version (any release before 2.10.24) and by a datasource being configured so the generated SQL actually executes. No user interaction and no special network configuration are needed beyond reachability of the DataEase application. The limiting factor is authentication plus chart-authoring/data-request privilege - instances that expose no such accounts to untrusted users are not remotely exploitable by anonymous attackers.

The CVSS 4.0 score of 8.7 (High) reflects a network-reachable (AV:N), low-complexity (AC:L), no-user-interaction (UI:N) attack requiring only low privileges (PR:L), with high confidentiality and integrity impact (VC:H/VI:H) and low availability impact (VA:L) confined to the vulnerable system (SC:N/SI:N/SA:N). Because DataEase executes generated SQL against configured datasources, successful injection can read and alter arbitrary data in those back-end databases, which justifies the H/H impact rating. The mitigating factor is PR:L: an attacker must already hold an account able to create/modify chart definitions or submit chart data requests, so this is not an unauthenticated internet-wide risk. No EPSS score, KEV listing, or POC was provided, so real-world exploitation probability is currently unquantified; the disclosed fixing commit does, however, hand any analyst a clear map of the vulnerable code, raising the practical likelihood of an exploit being derived. Net: a genuine high-priority patch item for any exposed DataEase instance with untrusted or low-trust users, but not an emergency drop-everything unauthenticated RCE.

A low-privileged DataEase user with rights to build or edit charts crafts a quota or Y-axis filter whose value contains SQL syntax; when DataEase renders the chart it embeds that value unescaped into the generated query, and the injected SQL executes against the configured datasource. The attacker uses this to read data from tables outside their intended scope or to tamper with records. No public exploit is identified at time of analysis, but the fixing commit publicly reveals the exact injectable parameter.