Dataease allows users to upload SVG images through its static resource interface. The server only verifies that the uploaded file is XML‑parseable and that the root element is an svg tag, but it does not remove or neutralise active content such as onload, onerror, or script‑capable attributes. Consequently an attacker who can submit an SVG file can embed malicious JavaScript payloads in the file. When a victim’s browser requests the stored static resource URL, the embedded script executes in the context of the page, allowing the attacker to steal cookies, hijack sessions, deface content, or otherwise compromise the integrity of the client environment. This is a classic Stored XSS vulnerability classified under CWE‑79.

All releases of Dataease version 2.10.19 and earlier are affected, as the flaw exists in the open‑source data visualization platform and has been fixed in version 2.10.20.

The CVSS score of 5.3 indicates a moderate level of impact. The EPSS score is below 1%, implying a low likelihood of current exploitation activity. The vulnerability is not listed in CISA’s known exploited vulnerabilities catalog. The attack path typically involves an attacker uploading a crafted SVG through the resource upload interface; the malicious payload is stored server‑side and becomes active when any user loads the static resource URL, completing a stored XSS exploitation chain that could cause client‑side data theft or session compromise.