DataEase, an open‑source analytics platform, shipped with a legacy commons‑collections library that contains a vulnerable deserialization gadget chain. The bundled Quartz scheduler deserializes job data from the database without a security filter or class allowlist. An attacker who authenticates to the application and can write to the job table—e.g., via the previously disclosed SQL injection in previewSql—can replace a job’s data BLOB with a crafted payload that triggers the InvokerTransformer gadget chain. When the Quartz job runs, the payload is deserialized and executed as the process owner inside the container, yielding full remote code execution. The weakness maps to CWE‑502 (Deserialization of Untrusted Data).

The vulnerability affects all DataEase instances running version 2.10.20 or earlier of the application, which includes the bundled velocity‑1.7.jar and quartz‑2.3.2.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, but because the flaw requires an attacker to gain write access to the Quartz job table, exploitation is limited to authenticated users with sufficient privileges. The vulnerability is not listed in the CISA KEV catalog. In practice, an attacker able to use the previewSql injection can overwrite job data and trigger the gadget chain via a cron trigger, achieving arbitrary code execution within the container.