CVE-2026-45417
Deferred Deferred - Pending Action

SQL Injection in DataEase Prior to 2.10.23

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema() into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvider#checkStatus, allowing SQL injection against DB2, SQL Server, PostgreSQL, and other affected datasources. This issue is fixed in version 2.10.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-16
Generated
2026-08-05
AI Q&A
2026-07-16
EPSS Evaluated
2026-08-03
NVD
CVE-2026-45417
EUVD
EUVD-2026-44776

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dataease dataease to 2.10.23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45417 is a SQL injection vulnerability in DataEase versions before 2.10.23. It occurs when user-controlled schema names are directly concatenated into SQL queries without sanitization in the getTablesSql function of the CalciteProvider class. This allows attackers to inject malicious SQL code, potentially accessing or manipulating unauthorized data.

Detection Guidance

To detect this vulnerability, inspect DataEase versions prior to 2.10.23 for SQL injection attempts in datasource connection checks. Monitor logs for unusual SQL queries or errors during schema validation. Check for blind SQL injection attempts by testing response delays during data source validation. Verify if user-controlled schema names are concatenated into SQL queries without sanitization.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary SQL commands on your database, leading to unauthorized data access, data manipulation, or even complete database compromise. Attackers might extract sensitive information, modify or delete data, or perform administrative operations depending on the database permissions.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized data access or breaches. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful exploit could result in data breaches, leading to legal penalties, fines, and reputational damage for organizations.

Mitigation Strategies

Upgrade DataEase to version 2.10.23 or later immediately to apply the security patch. If upgrading is not possible, restrict access to the CalciteProvider class and datasource configuration interfaces. Implement input validation for schema names and use parameterized queries instead of string concatenation. Monitor network traffic for suspicious SQL injection attempts targeting DB2, SQL Server, PostgreSQL, or other affected databases.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45417. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart