Cross-Site Scripting in Data Visualization Tool DataEase
CVE-2026-102756

5.1MEDIUM

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
14 October 2026

What is CVE-2026-102756?

DataEase, an open-source data visualization and analysis tool, has a vulnerability that allows authenticated users to exploit HTML-bearing dimension values in bar-horizontal charts. Prior to version 2.10.26, when category axis labels are truncated, the application retrieves the full label and assigns it to the g2-tooltip-title element using innerHTML. This results in a potential for executing attacker-controlled JavaScript if a victim hovers over the truncated label while accessing their dashboard. Users are encouraged to upgrade to version 2.10.26 to mitigate this issue.

Affected Version(s)

dataease < 2.10.26

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/8cc4dbd41d802...
x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.26
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.