DataEase, an open source data visualization platform, contains a stored SQL injection flaw that occurs when authenticated users save a custom dateFormat for a dataset field. The dateFormat string is inserted into various SQL‑generation templates without validation, allowing an attacker to embed malicious SQL fragments. When a chart renders the affected field, Calcite parsing is bypassed or the string is reserialized, letting the payload be executed directly against the backend database, thereby compromising confidentiality, integrity, and availability.

The vulnerability affects all installations of DataEase running any version earlier than 2.10.26. Authenticated users who can modify DatasetTableFieldDTO.dateFormat for any dataset field are impacted. The flaw exists across the product’s core modules such as Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str, and impacts both cross‑datasource and, with additional conditions, single‑datasource datasets.

With a CVSS score of 8.7, the flaw is considered high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. The likely attack vector requires authenticated access to the DataEase web interface and the ability to edit datasets. Once the malicious dateFormat is stored, any subsequent chart rendering that uses the affected field will trigger the injected SQL, allowing an attacker to read, modify, or delete data in the backend database. Given the lack of input validation, the exploitation can be performed by any authenticated user with dataset write privileges, making the exposure significant and the risk high.