DataEase is an open‑source data visualization and analysis tool. Prior to version 2.10.26, users who have permission to create folders can store folder names that contain HTML or JavaScript. When another user opens a Move‑to dialog, the stored name is read from a node title attribute and then placed into innerHTML, causing the attacker‑controlled script to execute in the victim’s session. This represents a stored cross‑site scripting vulnerability (CWE‑79) that allows arbitrary client‑side code execution during normal use of the application.

All versions of DataEase before 2.10.26 are affected. The flaw exists in the datasource and dataset creation endpoints (datasource/createFolder and datasetTree/save) and is fixed in release 2.10.26.

The CVSS score of 5.1 indicates moderate severity. Exploitation requires authentication and folder‑creation privileges, so the attack surface is limited to users who can create folders. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is unlikely at present. However, any user with creation permissions can embed malicious payloads that will run when other users view the folder name in a Move‑to dialog.