This vulnerability allows an authenticated user with permission to edit dataset fields and chart configuration to store an HTML‑bearing dimension value in a bar‑horizontal chart. When the chart truncates the category axis label, the application retrieves the full label and injects it into the tooltip title element using innerHTML. A user who views the dashboard and hovers over the truncated label can have attacker‑controlled JavaScript executed in that user’s browser session, potentially stealing session data or performing other malicious actions. The flaw is a classic stored cross‑site scripting error (CWE‑79).

Any instance of the open source DataEase data visualization platform that is running a version earlier than 2.10.26 is affected. The issue is present in the core front‑end code that handles bar‑horizontal charts. No other versions are impacted.

The CVSS score of 5.1 indicates moderate severity. The exploit requires that the attacker first creates or modifies a chart with a malicious label, which is possible only for users who have edit rights on dataset fields or chart configuration. Once the malicious chart is stored, any authenticated user who opens the corresponding dashboard and hovers over the truncated label will trigger the stored script. Because the flaw is stored rather than session‑only, it can affect many users in the organization. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting moderate exploitation probability and no publicly known active exploit code.