CVE-2026-104143: DataEase: Stored SQL Injection via dateFormat field templates
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.26
Event History
Frequently Asked Questions
Which deployments are most readily exploitable?
Cross-datasource datasets are the most readily exploitable because rendering a chart for the affected field bypasses Calcite parsing, allowing a crafted stored dateFormat value to directly alter generated SQL. Single-datasource datasets have an additional constraint: the payload must survive Calcite reserialization as a valid string literal.
What level of access does an attacker need?
An attacker must be authenticated and able to store a crafted custom dateFormat value for a dataset field. Exploitation occurs when a chart renders that field.
What should be done if an affected deployment cannot be upgraded immediately?
Limit access to users who can modify dataset field dateFormat values, and review existing custom dateFormat values for crafted input. Prioritize restricting or reviewing fields used by charts on cross-datasource datasets.
How can I determine whether the issue is fixed?
The issue is fixed in DataEase version 2.10.26. Deployments running versions prior to 2.10.26 are affected according to the provided advisory information.