CVE-2026-102756

Deferred Deferred - Pending Action

Stored XSS in DataEase Dashboard via Truncated Chart Labels

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102756

EUVD

EUVD-2026-101558

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	< 2.10.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in DataEase versions prior to 2.10.26. Authenticated users with edit permissions can inject malicious HTML/JavaScript into chart dimension values. When a victim views a dashboard and hovers over a truncated axis label, the tooltip executes the attacker's script in the victim's session.

Detection Guidance

Check DataEase versions prior to 2.10.26 for vulnerable charts with stored XSS payloads in axis labels. Inspect dashboard configurations and dataset fields for malicious HTML/JavaScript in bar-horizontal chart tooltips. Monitor browser console logs for unexpected script executions when hovering over truncated axis labels.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. This could lead to unauthorized data access, account takeover, or further compromise of your DataEase instance and connected systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Upgrade DataEase to version 2.10.26 or later immediately. Review and remove any suspicious dataset fields or dashboard configurations that may contain malicious payloads. Restrict user permissions to prevent unauthorized modifications to charts and datasets.

Hi! I’m here to help you understand CVE-2026-102756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70