Technical impact
DataEase is an open source data visualization and analysis tool. Prior to version 2.10.23, its SQL‑type datasets store attacker‑controlled SQL variable defaultValue entries such as ${var}. The SqlparserUtils.handleVariableDefaultValue() method inserts these defaults into queries using String.replace() without escaping or parameterization, leading to a stored SQL injection flaw that is triggered whenever a user with dataset read permission accesses the dataset. An attacker who can embed malicious SQL in a defaultValue can cause the DataEase backend to execute arbitrary SQL, potentially exposing, modifying, or destroying data.
Affected Systems
All instances of DataEase running a version earlier than 2.10.23 are affected. The vulnerability is present in the dataease product and does not involve any other components or third‑party libraries.
Risk and Exploitability
The CVSS score of 8.7 reflects a high‑severity flaw, while the EPSS score of less than 1% indicates that exploitation attempts are unlikely as of now. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to embed SQL in a dataset’s defaultValue and a legitimate user with read access to that dataset must view it. Once triggered, the injected SQL runs with the database user privileges of the DataEase application.
