Which versions of DataEase are affected by EUVD-2026-44775?

DataEase versions prior to 2.10.23 contain a critical remote code execution vulnerability that allows authenticated users with Redshift datasource configuration privileges to execute arbitrary code…. A patch is available.

How to fix or mitigate EUVD-2026-44775?

Within 24 hours, identify all DataEase deployments in your environment and determine their current versions to assess exposure. Within 7 days, apply the vendor-released patch to upgrade all affected instances to DataEase 2.10.23 or later, prioritizing production environments. Within 30 days, verify complete patch coverage across all DataEase instances, implement stricter access controls limiting Redshift datasource configuration permissions to essential personnel only, and audit datasource configuration change logs for suspicious modifications.

DataEase EUVD-2026-44775

Q: What is the CVSS score of EUVD-2026-44775?

EUVD-2026-44775 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-45534 CRITICAL

Code Injection (CWE-94)

2026-07-15 GitHub_M

RCE Code Injection Dataease

9.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Authenticated operator can trigger it (PR:L), but staging rsjdbc.ini in tmpdir raises complexity (AC:H); RCE escapes the app component into the host, so S:C with full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:01 vuln.today

Analysis Generated

Jul 15, 2026 - 20:01 vuln.today

CVE Published

Jul 15, 2026 - 19:19 cve.org

CRITICAL 9.0

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled rsjdbc.ini configuration from System.getProperty("java.io.tmpdir"), setting socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext so com.amazon.redshift.Driver#connect, com.amazon.redshift.Driver#getJdbcIniFile, and com.amazon.redshift.util.ObjectFactory#instantiate execute a reflection-based remote code execution chain during a normal JDBC connection through io.dataease.datasource.type.Redshift. This issue is fixed in version 2.10.23.

AnalysisAI

Reflection-based remote code execution in DataEase before 2.10.23 lets an authenticated operator who can configure a Redshift datasource achieve arbitrary code execution on the server. The Redshift JDBC driver loads an attacker-controlled rsjdbc.ini from the system temp directory and honors a malicious socketFactory pointing at Spring's FileSystemXmlApplicationContext, turning a normal JDBC connection into a code-execution chain. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor has confirmed and patched the flaw in 2.10.23.

Technical ContextAI

DataEase is an open-source business-intelligence and data-visualization platform (Java/Spring Boot backend). The flaw sits in the Redshift datasource integration (io.dataease.datasource.type.Redshift) which uses Amazon's Redshift JDBC driver. During connection the driver (com.amazon.redshift.Driver#getJdbcIniFile) reads an rsjdbc.ini file resolved from System.getProperty("java.io.tmpdir"). By setting socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext, the driver's com.amazon.redshift.util.ObjectFactory#instantiate reflectively loads a Spring application context from an attacker-supplied XML bean definition, executing arbitrary code. This is a classic CWE-94 (Code Injection) rooted in trusting a world-writable configuration location plus an unsafe reflective factory - conceptually similar to socketFactory/JDBC-driver gadget abuse seen in other JDBC connectors.

RemediationAI

Vendor-released patch: 2.10.23 - upgrade DataEase to 2.10.23 or later, which per the fix commit (3e58149f1e014b1a7ae2c12134b37ae438f676ac) hardens startup by setting AMAZON_REDSHIFT_JDBC_INI_FILE, user.home, and java.io.tmpdir to "null" so the Redshift driver no longer loads an attacker-controlled rsjdbc.ini. If you cannot upgrade immediately, apply the same JVM-level neutralization by launching the DataEase backend with -DAMAZON_REDSHIFT_JDBC_INI_FILE=null and overriding the effective java.io.tmpdir/user.home the driver reads, and restrict who can create or edit Redshift datasources to trusted administrators only (side effect: legitimate operators lose self-service datasource creation); additionally lock down filesystem permissions on the server temp directory so untrusted processes/users cannot write rsjdbc.ini there. Reference the advisory at https://github.com/dataease/dataease/security/advisories/GHSA-cv4c-8rpv-2x97 and the patch commit https://github.com/dataease/dataease/commit/3e58149f1e014b1a7ae2c12134b37ae438f676ac.