SQL Injection Vulnerability in DataEase Data Visualization Tool
CVE-2026-104142

8.7HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
14 October 2026

What is CVE-2026-104142?

The DataEase data visualization and analysis tool prior to version 2.10.26 is susceptible to a stored SQL injection vulnerability. Authenticated users can manipulate specific input fields such as FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime within dataset group-field binning definitions. The lack of input validation in the Utils.transGroupFieldToSql function allows these crafted inputs to be inserted into generated SQL CASE expressions without proper sanitization. When a chart utilizes these fields, it can lead to unparameterized SQL queries execution on the backend database. This vulnerability poses a significant risk by potentially compromising the confidentiality, integrity, and availability of the database's information.

Affected Version(s)

dataease < 2.10.26

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/59191a17657b7...
x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.26
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.