CVE-2026-123992
Deferred Deferred - Pending Action

Cross-Site Scripting in DataEase

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: VulDB

Description
A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 2.10.28 can resolve this issue. This patch is called 0709fe98d6608c3507daee3e92cf433e7ff61370. You should upgrade the affected component. The vendor confirms: "The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-123992
EUVD
EUVD-2026-119318

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dataease dataease to 2.10.27 (inc)
dataease dataease 2.10.28

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in DataEase versions up to 2.10.27. It exists in the StaticResourceServer.validateSvgContent function which handles SVG files. An attacker can manipulate SVG content to inject malicious scripts that execute in a user's browser when the SVG is viewed. The issue arises from insufficient input validation in SVG processing.

Detection Guidance

Detecting this vulnerability requires checking for affected DataEase versions and inspecting SVG handling in the core-backend component. Verify if the installed version is below 2.10.28. Inspect the StaticResourceServer.java file for the validateSvgContent function. Look for signs of XSS attempts in SVG files or server responses.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary JavaScript code in the context of a user's browser session. This could lead to theft of session cookies, account takeover, or delivery of malware. Users viewing malicious SVG files through DataEase could be affected. The impact is limited to users interacting with compromised SVG content.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations if user data is compromised through this attack vector.

Mitigation Strategies

Immediately upgrade DataEase to version 2.10.28 or later. Apply the patch 0709fe98d6608c3507daee3e92cf433e7ff61370. Ensure SVG security hardening is active, including namespace-aware allowlists and restrictive Content Security Policy for SVG responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123992. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...