CVE-2026-45417: DataEase: SQL injection vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45417?
CVE-2026-45417 has a risk score of 62, indicating a moderate severity level.
How do I fix CVE-2026-45417?
To fix CVE-2026-45417, upgrade DataEase to version 2.10.23 or later.
What type of vulnerability is CVE-2026-45417?
CVE-2026-45417 is classified as an SQL injection vulnerability.
Who is affected by CVE-2026-45417?
Users of DataEase prior to version 2.10.23 are affected by CVE-2026-45417.
What can attackers do with CVE-2026-45417?
Attackers exploiting CVE-2026-45417 may execute arbitrary SQL queries leading to unauthorized access to the database.