Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-45417DataEase: SQL injection vulnerability

High 8.7

In plain English

A high-severity SQL injection in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 68.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.23

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-rg6c-r9mv-39fr x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/f1c7204da1787ef812ee23cd3d51a1824126c1fb x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.23 x_refsource_MISC