PT-2026-60272 · Dataease · Dataease

CVE-2026-45320 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.23

Description Authenticated users with dashboard view permissions can perform SQL injection against integrated datasources. The issue occurs because dashboard SQL variables, such as ${deptId}, are processed by the transFilter() function in SqlparserUtils. For operators other than in and between, the final branch of this function returns raw user input, which is then spliced into the dashboard SQL via the replace() function in SubstitutedSql.

Recommendations Update to version 2.10.23.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-45320

GHSA-8VP9-9HX4-6458

Affected Products

Dataease

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45320.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45320 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45320 · Vendor Advisory
• https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13 · Note
• https://github.com/dataease/dataease/security/advisories/GHSA-8vp9-9hx4-6458 · Note
• https://github.com/dataease/dataease/releases/tag/v2.10.23 · Note