DataEase: Stored SQL injection in group-field binning bounds
Summary
DataEase, an open source data visualization and analysis tool, does not validate the min, max, startTime and endTime values of dataset group-field binning definitions. These values are inserted into generated SQL CASE expressions, so an authenticated user can store SQL injection payloads that run when a chart uses the field. Successful exploitation could affect the confidentiality, integrity and availability of the connected backend database.
Affected
- DataEase versions before 2.10.26
- Earliest affected version: Unknown.
Fixed in
- Fixed in DataEase 2.10.26 (commit 59191a17657b75d0721e428c10bc0065c3310b17).
Workaround
- No vendor-documented workaround. Upgrading is the recommended fix.
Exploitation
- Requires a valid login (PR:L) and the ability to edit dataset group-field binning.
- CISA SSVC: exploitation status poc, not automatable.
- Not listed in CISA KEV.
- No confirmed exploitation known.
Our recommendation
- Identify all DataEase instances and their exact versions.
- Upgrade all instances below 2.10.26 to 2.10.26 or later after testing.
- Restrict dataset and chart-editing rights to users who need them.
- Review existing group-field binning definitions for unusual min, max, startTime or endTime values.
- Check whether the DataEase instance is reachable from the internet.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gcr3-cj2q-gj4q github.com
- Fix commit 59191a17657b75d0721e428c10bc0065c3310b17 github.com
- DataEase release v2.10.26 github.com
- Vulners CVE-2026-104142 vulners.com
- VulDB 420320 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:45.
Original description (NVD)
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.