DataEase is an open source data visualization and analysis tool. Prior to version 2.10.23, DataEase Redshift datasource connections can load attacker‑controlled rsjdbc.ini configuration from System.getProperty("java.io.tmpdir"), setting socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext so com.amazon.redshift.Driver#connect, com.amazon.redshift.Driver#getJdbcIniFile, and com.amazon.redshift.util.ObjectFactory#instantiate execute a reflection‑based remote code execution chain during a normal JDBC connection through io.dataease.datasource.type.Redshift. This issue is fixed in version 2.10.23. The flaw allows an attacker to execute arbitrary Java code with the privileges of the DataEase process, which is a CWE‑94 code‑generation or execution vulnerability.

DataEase processes Redshift JDBC connections and is affected for all releases prior to 2.10.23. The vulnerable code path is within the io.dataease.datasource.type.Redshift component of the dataease:dataease product. Any installation that uses a Redshift datasource and can write to the system temporary directory is susceptible; this includes both server‑side deployments and any client that may be able to create files in java.io.tmpdir. Vendors should identify installations of dataease:dataease older than the patched version.

The CVSS score of 9 indicates that an exploited vulnerability would allow any compromised attacker to execute arbitrary code with the privileges of the DataEase process. The EPSS score is reported as <1 %, meaning the probability of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog, showing no confirmed widespread attacks. Nonetheless, the nature of the flaw—triggered by a normal JDBC connection—suggests that an attacker who can form a connection to the DataEase server (for example, an authenticated user or someone who can supply a JDBC URL) could potentially supply a crafted rsjdbc.ini file and achieve remote code execution. Because the exploit requires file system write access to the temporary directory, the attack surface is limited, but not negligible for environments where temporary files are not tightly controlled.