CVE-2026-102756: DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/commonantv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.26
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must be able to edit dataset fields and chart configuration. They can store an HTML-bearing dimension value in a bar-horizontal chart.
What must happen for the stored payload to execute?
The category axis label must be truncated by lengthLimit. A victim must then open the affected dashboard and hover the truncated label, causing the full label to be assigned through innerHTML.
Which deployments are affected?
DataEase versions prior to 2.10.26 are affected where users can edit dataset fields and chart configuration and use bar-horizontal charts with truncated category-axis labels.
What should be done if an immediate upgrade is not possible?
Limit access to editing dataset fields and chart configuration, especially for untrusted users. Review bar-horizontal charts for HTML-bearing dimension values and avoid configurations that truncate category-axis labels until the fix can be applied.
How can administrators identify potentially affected content?
Review bar-horizontal charts configured with lengthLimit and inspect their dimension values for HTML-bearing content. Prioritize dashboards that may be opened by other users, since execution occurs when a viewer hovers a truncated label.