Data Visualization Tool Vulnerability in DataEase by DataEase

CVE-2026-104143

What is CVE-2026-104143?

DataEase, an open-source data visualization and analysis tool, has a notable vulnerability in versions prior to 2.10.26. Authenticated users can input a crafted custom dateFormat for dataset fields, which is then improperly validated. This input is directly integrated into SQL conversion templates used throughout the system, allowing for a bypass of the Calcite parsing mechanism. Consequently, when rendering charts on cross-datasource datasets, the exploitation of this vulnerability enables direct manipulation of generated SQL queries. Additionally, on single-datasource datasets, the crafted input must successfully endure Calcite reserialization as a valid string literal, compounding the risk. Such exploitation can severely compromise the confidentiality, integrity, and availability of backend databases. The issue has been addressed and resolved in version 2.10.26.

References