Cross-Site Scripting Vulnerability in DataEase SVG Handler

CVE-2026-123992

What is CVE-2026-123992?

A vulnerability exists in DataEase's SVG Handler that can be exploited to perform cross-site scripting attacks. This flaw arises in the StaticResourceServer.validateSvgContent function, affecting versions of DataEase up to 2.10.27. Attackers can manipulate SVG content, potentially allowing remote code execution. To address this issue, it is recommended to upgrade to version 2.10.28, which replaces blacklist-based checks with a more secure allowlist approach, incorporates a strict Content Security Policy, and restricts references to document-local fragments.

References