Vulnerability · Published Nov 6, 2025 · Assigned by GitHub_M

CVE-2025-64164DataEase is vulnerable to Oracle JNDI Injection

High 8.9

In plain English

A high-severity unsafe deserialization in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High

Exploit odds (30 days)0.6%top 49.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection (Java Naming and Directory Interface injection). This issue is fixed in version 2.10.15.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.15

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References

https://github.com/dataease/dataease/security/advisories/GHSA-q754-4pc2-wjqw x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/7b68eb3dfccbbd12ec977e6320dbd3e32a7bbfe6 x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.15 x_refsource_MISC