Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-53751DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)

High 8.7

In plain English

A high-severity code injection in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.6%top 51.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous parameters such as init in malicious H2 JDBC connection strings and achieve arbitrary code execution. This issue is fixed in version 2.10.24.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.24

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-xjhm-r8p8-c2cg x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/2204258118eac6160a6636ca20dbedb0d3f95747 x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.24 x_refsource_MISC