Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-49867DataEase: Authenticated Stored XSS in DataEase Template Static Resources

Medium 6.3

In plain English

A medium-severity cross-site scripting in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 59.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/<name>.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.23

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-jqxj-h53x-mpvf x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/b00d9e3a73a9653bfc3ea0c41c0c3a5b0dd40bf8 x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.23 x_refsource_MISC