DataEase is an open source data visualization and analysis tool. Prior to version 2.10.23, its SQL‑type datasets store attacker‑controlled SQL variable defaultValue entries such as ${var}. The SqlparserUtils.handleVariableDefaultValue() method inserts these defaults into queries using String.replace() without escaping or parameterization, leading to a stored SQL injection flaw that is triggered whenever a user with dataset read permission accesses the dataset. An attacker who can embed malicious SQL in a defaultValue can cause the DataEase backend to execute arbitrary SQL, potentially exposing, modifying, or destroying data.

All instances of DataEase running a version earlier than 2.10.23 are affected. The vulnerability is present in the dataease product and does not involve any other components or third‑party libraries.

The CVSS score of 8.7 reflects a high‑severity flaw, while the EPSS score of less than 1% indicates that exploitation attempts are unlikely as of now. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to embed SQL in a dataset’s defaultValue and a legitimate user with read access to that dataset must view it. Once triggered, the injected SQL runs with the database user privileges of the DataEase application.