DataEase is an open‑source data visualization and analysis platform. Before version 2.10.23, dashboard SQL variables such as ${deptId} were processed by SqlparserUtils.transFilter(). In its final branch the function returned raw user input for operators other than IN and BETWEEN, and SubstitutedSql.replace("${var}", value) subsequently spliced this unfiltered input into the final dashboard SQL. Authenticated users with permission to view a dashboard could therefore inject arbitrary SQL against the integrated data sources, enabling read, modify, delete or other data‑exfiltration operations. The vulnerability is fixed starting in release 2.10.23.

All versions of DataEase released prior to 2.10.23 are affected. The vulnerability exists in the dataease product where dashboard SQL variables such as ${deptId} are processed without proper filtering.

With a CVSS score of 8.7 the vulnerability is considered high severity, but the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, and exploitation requires the attacker to have authenticated access to a dashboard, which is a common privilege in many deployments. Consequently, the risk is moderate to high for organizations that grant widespread dashboard access, but overall exploitation likelihood remains low. The attack vector is likely through the application, leveraging legitimate dashboard viewing permissions.