CVE-2026-102755

Deferred Deferred - Pending Action

Stored XSS in DataEase via Folder Name Manipulation

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue read the stored name from a node title attribute and assign search-highlighted content to innerHTML. When another user opens a Move to dialog and types in its search box, attacker-controlled JavaScript can execute in the victim's DataEase session. This issue is fixed in version 2.10.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102755

EUVD

EUVD-2026-101560

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	< 2.10.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in DataEase, an open-source data visualization tool. Authenticated users with folder creation permissions can inject malicious JavaScript into folder names via datasource/createFolder or datasetTree/save endpoints. When other users search in the Move to dialog, the unsafe rendering of folder names using innerHTML executes the attacker's script in their session.

Detection Guidance

Check for DataEase versions prior to 2.10.26 by inspecting the version in your deployment. Look for suspicious folder names containing HTML or JavaScript in datasource/dataset folders via the admin interface or API endpoints /de2api/datasource/createFolder and /de2api/datasetTree/save.

Impact Analysis

An attacker could perform actions on your behalf, modify resources, or steal sensitive data from your DataEase session. This includes accessing or exfiltrating data you can view or interact with in the application.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive health information. Compliance may be compromised if personal or protected data is exposed.

Mitigation Strategies

Upgrade DataEase to version 2.10.26 or later immediately. Review and remove any folder names containing HTML or JavaScript payloads in datasource and dataset folders. Restrict folder creation permissions to trusted users only.

Hi! I’m here to help you understand CVE-2026-102755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70