CVE-2026-45320: DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace("${var}", value) splices it into dashboard SQL, allowing authenticated users who can view a dashboard to inject SQL against integrated datasources. This issue is fixed in version 2.10.23
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEase Data Dashboardto a version that resolves this vulnerability.Fixed in 2.10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45320?
CVE-2026-45320 has a risk score of 62, indicating a medium to high severity level.
How do I fix CVE-2026-45320?
To fix CVE-2026-45320, upgrade to DataEase version 2.10.23 or later where the vulnerability is patched.
What type of vulnerability is CVE-2026-45320?
CVE-2026-45320 is classified as an SQL Injection vulnerability.
Who is affected by CVE-2026-45320?
Users of DataEase Data Dashboard versions prior to 2.10.23 are affected by CVE-2026-45320.
How does CVE-2026-45320 impact DataEase users?
CVE-2026-45320 allows an attacker to execute unfiltered SQL commands, potentially compromising the integrity of the database.