CVE-2026-102755 in DataEase
Summary
by MITRE • 10/14/2026
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue read the stored name from a node title attribute and assign search-highlighted content to innerHTML. When another user opens a Move to dialog and types in its search box, attacker-controlled JavaScript can execute in the victim's DataEase session. This issue is fixed in version 2.10.26.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in DataEase prior to version 2.10.26 represents a classic Stored Cross-Site Scripting (XSS) flaw rooted in improper input validation and unsafe DOM manipulation within the application's frontend architecture. As an open-source data visualization platform, DataEase relies heavily on user-generated content for organizing datasets and visualizations. The specific attack vector exploits the folder creation functionality accessible to authenticated users who possess permission to create folders. By leveraging endpoints such as datasource/createFolder or datasetTree/save, a malicious actor can inject HTML-bearing names into the system's database. This capability allows an attacker to store arbitrary JavaScript code within metadata fields that are subsequently rendered by the application without adequate sanitization.
The technical mechanism of exploitation centers on how the frontend components handle user input during search operations within specific dialogs. The files core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue are responsible for managing folder navigation and organization. When a victim user opens the Move to dialog, they may utilize the search box to locate specific folders or datasets. The application retrieves the name of these items from node title attributes stored in the DOM structure. Crucially, instead of treating this data as plain text, the framework assigns it directly to innerHTML properties after applying search highlighting logic. This practice bypasses standard security controls because innerHTML interprets any HTML tags present in the string as executable markup rather than literal characters. Consequently, if an attacker has previously stored a folder name containing malicious script payloads, that code is executed within the context of the victim's active session whenever they perform a search operation involving those items.
The operational impact of this vulnerability is severe due to its authenticated nature and potential for stealthy execution. Since the payload is stored server-side or in persistent client storage associated with specific data entities, it does not require social engineering tactics like phishing links to trigger; rather, it activates simply by a victim navigating their own workspace. Once executed, the attacker-controlled JavaScript runs with the same privileges as the legitimate user. This enables session hijacking through cookie theft, allowing the adversary to impersonate the victim and gain unauthorized access to sensitive data visualizations or underlying datasets. Furthermore, depending on the specific scripts injected, attackers could perform actions on behalf of the user, such as modifying configurations, deleting critical resources, or exfiltrating information from connected databases. The persistence of this threat means that every subsequent interaction with affected folders by any authorized user poses a risk until the vulnerability is remediated.
From a classification perspective, this flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the subcategory involving DOM-based XSS where client-side scripts process data from an unusual source and write it to a location that can be interpreted as executable code by the browser. In terms of offensive security frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. The attack chain involves initial access via valid credentials followed by persistence through stored payloads and eventual impact via session takeover or data manipulation.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is to upgrade DataEase to version 2.10.26 or later, where the developers have addressed this issue by implementing proper input sanitization and output encoding mechanisms within the specified Vue components. Developers should ensure that all dynamic content inserted into innerHTML properties is first passed through a robust sanitizer library such as DOMPurify to strip out dangerous tags like script, object, and event handlers before rendering. Additionally, adopting Content Security Policy (CSP) headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact even if XSS vulnerabilities persist in legacy codebases. Regular security audits focusing on frontend data binding practices are essential to prevent similar flaws arising from future feature additions or modifications to the visualization engine.