Vulnerability · Published Aug 25, 2025 · Assigned by GitHub_M

CVE-2025-57772Dataease H2 JDBC RCE Bypass

High 8.2

In plain English

A high-severity code injection in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 10.9% (higher than 96% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)10.9%top 4.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing the "driver":"org.h2.Driver" to specify the H2 driver for the JDBC connection. The vulnerability has been fixed in version 2.10.12.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.12

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-v37q-vh67-9rqv x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/1644d81dff46272b09570fa1f4a8f83f01f37440 x_refsource_MISC