PT-2026-60273 · Dataease · Dataease

CVE-2026-45417 · Published 2026-07-15 · Updated 2026-07-15

NVD

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-45417

Affected Products

Dataease

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-45417 · Security Note
• https://github.com/dataease/dataease/releases/tag/v2.10.23 · Note
• https://github.com/dataease/dataease/security/advisories/GHSA-rg6c-r9mv-39fr · Note
• https://github.com/dataease/dataease/commit/f1c7204da1787ef812ee23cd3d51a1824126c1fb · Note