EUVD-2026-44776Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with low complexity and no UI, but requires an authenticated user able to edit datasource config (PR:L); high confidentiality/integrity on the backend DB, low availability.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.
AnalysisAI
SQL injection in DataEase before 2.10.23 lets an authenticated low-privilege user compromise the backend datasource by abusing the datasource connection-status check, where io.dataease.datasource.provider.CalciteProvider#checkStatus concatenates the user-controlled configuration.getSchema() value into getTablesSql and runs it via executeQuery. Because the schema/owner string is embedded directly into metadata queries for DB2, SQL Server, PostgreSQL, Oracle and other datasources, an attacker who can create or edit a datasource can inject arbitrary SQL and read or alter data on the connected database. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor commit that replaces string concatenation with parameterized PreparedStatements.
Technical ContextAI
DataEase is an open-source business-intelligence and data-visualization platform (Java/Spring backend) that connects to external relational databases as 'datasources'. The flaw is a classic CWE-89 SQL Injection: the CalciteProvider builds metadata-listing queries (e.g. 'select table_name, comments, owner from all_tab_comments where owner='...'' for Oracle, 'select TABNAME, REMARKS from syscat.tables WHERE TABSCHEMA ='...'' for DB2, and INFORMATION_SCHEMA.TABLES lookups for others) by inserting configuration.getSchema() with Java String.format/concatenation instead of a bound parameter. The 'checkStatus' path and the table-enumeration path both take the first getTablesSql entry and pass it to Statement.executeQuery, so any injection in the schema field executes on the target DBMS. The vendor fix (commit f1c7204) introduces a QueryAndParams object and prepareStatement so the schema is passed as a '?' bind variable, closing the injection across all provider branches.
RemediationAI
Vendor-released patch: upgrade to DataEase 2.10.23 or later, which is the fixed release per the advisory (https://github.com/dataease/dataease/releases/tag/v2.10.23) and commit f1c7204da1787ef812ee23cd3d51a1824126c1fb that replaces concatenated schema values with parameterized PreparedStatements. If you cannot upgrade immediately, restrict who can create or edit datasource configurations by tightening DataEase role permissions so only fully trusted administrators hold that capability, which removes the low-privilege attack surface at the cost of reducing self-service datasource management; additionally place DataEase behind network controls so the management UI/API is not broadly reachable, and grant each configured datasource database account only least-privilege read access to limit the blast radius of any injection (trade-off: some metadata/enumeration features may be constrained). Review the referenced GitHub advisory (GHSA-rg6c-r9mv-39fr) for exact upgrade guidance.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today