DataEase is an open source data visualization and analysis tool. Before version 2.10.23, the application concatenates the schema value from configuration.getSchema() into the SQL string produced by getTablesSql and executes it with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus. This allows an attacker to supply a crafted schema string and inject arbitrary SQL against databases such as DB2, SQL Server, PostgreSQL, and others. The vulnerability is fixed in DataEase 2.10.23.

Versions of DataEase earlier than 2.10.23 are affected; the product is identified as DataEase (dataease:dataease). All supported database types (DB2, SQL Server, PostgreSQL, and other datasources) used with these versions are at risk.

The CVSS score of 8.7 indicates a high severity vulnerability, and the EPSS score of less than 1% shows a very low probability of exploitation at this time; it is not listed in CISA’s KEV catalog. The likely attack vector is remote, via any interface that triggers a connection status check—such as web or API endpoints that accept user‑supplied schema values. An attacker who can supply the schema parameter would be able to execute arbitrary SQL against the connected database, compromising confidentiality and integrity of the data layer; the impact is limited to systems that allow such status checks to be performed by the attacker.