CVE-2026-90529: DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting
A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic Map. Such manipulation of the argument canvasViewInfo[].customAttr.tooltip.backgroundColor leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The listed vector requires low-privileged access and user interaction. The attacker can perform the attack remotely, but must be able to manipulate canvasViewInfo[*].customAttr.tooltip.backgroundColor.
Which deployments are known to be affected?
DataEase versions up to 2.10.25 and 2.10.26 are identified as affected. The available information does not state whether the vulnerable setting is enabled or reachable in a default configuration.
What is the impact of successful exploitation?
Successful manipulation can lead to cross-site scripting through the Symbolic Map tooltip backgroundColor value. The provided severity vector indicates integrity impact but no stated confidentiality or availability impact.
Is a vendor fix available?
No vendor response is reported. The project was notified through an issue report, but had not responded at the time of publication.