CVE-2026-104142: DataEase: Stored SQL Injection in group-field binning bounds
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.26
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated DataEase user who can store or modify dataset group-field binning definitions with crafted min, max, startTime, or endTime values can exploit it. The injected SQL is executed when a chart uses the affected field.
Which deployments are affected?
DataEase versions prior to 2.10.26 are affected where charts use group-field binning definitions containing these values. The issue can affect the confidentiality, integrity, and availability of the configured backend database.
What should teams do if they cannot upgrade immediately?
The provided information identifies upgrading to DataEase 2.10.26 as the available fix. Until then, restrict authenticated users' ability to create or modify dataset group-field binning definitions and review existing definitions for unexpected values in min, max, startTime, or endTime.
How can administrators identify potentially affected stored configurations?
Inspect dataset group-field binning definitions for free-form or unexpected content in FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, and FieldGroupDTO.endTime. Prioritize definitions used by charts, because use of the field can cause the generated SQL to reach backend query execution.