CVE-2026-104143

Deferred Deferred - Pending Action

SQL Injection via Crafted DateFormat in DataEase

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL. On a single-datasource dataset, exploitation additionally requires the payload to survive Calcite reserialization as a valid string literal. Successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. This issue is fixed in version 2.10.26.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104143

EUVD

EUVD-2026-101556

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	< 2.10.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-289	The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

Executive Summary

This is a stored SQL injection vulnerability in DataEase, a data visualization tool. Authenticated users can inject malicious SQL payloads into the dateFormat field of a dataset. When a chart renders this field, the payload executes, compromising the database. The issue occurs due to lack of input validation for the dateFormat field.

Detection Guidance

Check DataEase logs for suspicious dateFormat values in dataset fields. Look for custom date formats containing SQL keywords like UNION, SELECT, or semicolons. Inspect rendered charts for unexpected SQL errors or unusual query patterns.

Impact Analysis

An attacker could steal, modify, or delete sensitive data, disrupt database operations, or gain unauthorized access to the system. The impact depends on the database permissions and data stored. Cross-datasource datasets are particularly vulnerable as the injection bypasses Calcite parsing entirely.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised sensitive data.

Mitigation Strategies

Upgrade DataEase to version 2.10.26 or later immediately. If upgrading is not possible, restrict authenticated user access to dataset configuration and review all custom dateFormat fields for malicious payloads.

Hi! I’m here to help you understand CVE-2026-104143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70