SQL Injection Vulnerability in DataEase Open Source Visualization Tool
CVE-2026-45535

8.7HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
15 July 2026

What is CVE-2026-45535?

DataEase, an open source tool for data visualization and analysis, has a vulnerability in its handling of SQL-type datasets. Prior to version 2.10.23, the application allows attacker-controlled entries for SQL variable default values. These are inserted unsanitized using String.replace(), leading to stored SQL injection when a user with dataset read permission accesses the dataset. This exploit potentially compromises the integrity of the database and allows unauthorized data manipulation.

Affected Version(s)

dataease < 2.10.23

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/22930a493d900...
x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.23
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.