CVE-2026-102755: DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue read the stored name from a node title attribute and assign search-highlighted content to innerHTML. When another user opens a Move to dialog and types in its search box, attacker-controlled JavaScript can execute in the victim's DataEase session. This issue is fixed in version 2.10.26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.26
Event History
Frequently Asked Questions
Who can exploit this issue, and what permissions are required?
An authenticated DataEase user needs permission to create folders. They can inject an HTML-bearing folder name through datasource/createFolder or datasetTree/save.
What must a victim do for the stored payload to execute?
Another user must open a datasource or dataset Move to dialog and enter text in that dialog's search box. The search highlighting path assigns attacker-controlled folder-name content to innerHTML, allowing JavaScript to run in the victim's DataEase session.
Which versions are affected and what is the remediation?
The issue affects DataEase versions before 2.10.26. Upgrade to version 2.10.26, which fixes the vulnerability.