Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-104142DataEase: Stored SQL Injection in group-field binning bounds

High 8.7

In plain English

A high-severity SQL injection in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.26

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-gcr3-cj2q-gj4q x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/59191a17657b75d0721e428c10bc0065c3310b17 x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.26 x_refsource_MISC