CVE-2026-55647: DataEase: authenticated stored XSS in the dashboard text components
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable event handlers that execute when another user or shared-link visitor views the dashboard. This issue is fixed in version 2.10.24.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55647?
CVE-2026-55647 has a medium severity rating of 5.1 according to the CVSS score.
How can I fix CVE-2026-55647?
To mitigate CVE-2026-55647, upgrade to DataEase version 2.10.24 or later, which includes proper HTML sanitization.
What is the impact of CVE-2026-55647?
CVE-2026-55647 allows an authenticated user to perform authenticated stored cross-site scripting (XSS) within dashboard text components.
Who is affected by CVE-2026-55647?
Users of DataEase versions prior to 2.10.24 who have the ability to edit dashboard component data are affected by CVE-2026-55647.
What does CVE-2026-55647 exploit?
CVE-2026-55647 exploits the lack of server-side HTML sanitization in DataEase's dashboard text components.