Vulnerability · Published Oct 17, 2025 · Assigned by GitHub_M

CVE-2025-62419DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration

High 8.2

In plain English

A high-severity unsafe deserialization in dataease from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.4%top 62.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE values are directly concatenated into the JDBC URL without filtering illegal parameters. This allows an attacker to inject a malicious JDBC string into the HOSTNAME field to bypass previously patched vulnerabilities CVE-2025-57773 and CVE-2025-58045. The vulnerability is fixed in version 2.10.14. No known workarounds exist.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.14

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-x4x9-mjcf-99r9 x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/bb320e42bf2cf862b9c4b438c1517547b53ed67b x_refsource_MISC