CVE-2026-45535: DataEase: Stored SQL Injection Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries such as ${var} and SqlparserUtils.handleVariableDefaultValue() inserts them with String.replace() without escaping or parameterization, causing stored SQL injection whenever a user with dataset read permission accesses the dataset. This issue is fixed in version 2.10.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45535?
The severity of CVE-2026-45535 is rated as 65, indicating a moderate risk.
What kind of vulnerability is CVE-2026-45535?
CVE-2026-45535 is a stored SQL injection vulnerability found in DataEase.
How do I fix CVE-2026-45535?
To fix CVE-2026-45535, update your DataEase software to version 2.10.23 or later.
Who is affected by CVE-2026-45535?
Users of DataEase prior to version 2.10.23 are affected by CVE-2026-45535.
What can attackers do with CVE-2026-45535?
Attackers exploiting CVE-2026-45535 can execute arbitrary SQL commands in the context of the database.