CVE-2026-55635: DataEase SQL Injection Vulnerability

CVE-2026-55635 Overview

CVE-2026-55635 is a SQL injection vulnerability [CWE-89] in DataEase, an open source data visualization and analysis tool. Versions prior to 2.10.24 embed attacker-controlled filter values directly into generated SQL inside the Quota2SQLObj.getYWheres() method. Unlike other filter paths in DataEase, this code path skipped the SQL literal validation and escaping routines. Authenticated users who can create or modify chart definitions, or submit chart data requests containing quota filters, can inject arbitrary SQL that executes against configured datasources. The issue is fixed in version 2.10.24.

Critical Impact
An authenticated attacker can inject SQL through chart quota and Y-axis filters, allowing unauthorized query execution against backend datasources connected to DataEase.

Affected Products

DataEase versions prior to 2.10.24
The Quota2SQLObj.getYWheres() code path in core/core-backend
Chart quota and Y-axis filter functionality

Discovery Timeline

2026-07-07 - CVE-2026-55635 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55635

Vulnerability Analysis

The vulnerability resides in Quota2SQLObj.getYWheres() within the DataEase backend engine. This method constructs SQL WHERE clauses for chart quota filters by concatenating raw filter values into query strings. Three filter operators are affected: in, like, and the default equality operator. Each branch builds the whereValue by inline string interpolation using f.getValue() without sanitization.

Because DataEase forwards the resulting SQL to configured datasources, an attacker with permission to create or edit charts can pivot into arbitrary read or write operations on backend databases. Impact depends on the privileges granted to the datasource connection user.

Root Cause

Other filter code paths in DataEase apply a sanitizeSqlLiteral() routine that escapes SQL literals and validates input. The getYWheres() method omitted this call, treating quota filter values as trusted. The root cause is inconsistent application of the existing input sanitization API across filter builders.

Attack Vector

Exploitation requires authenticated access with permission to create, modify, or execute chart data requests that carry quota filters. The attacker submits crafted filter values containing SQL metacharacters. The server assembles the query and dispatches it to a configured datasource, executing the injected payload.

java

                } else if (StringUtils.equalsIgnoreCase(f.getTerm(), "not_empty")) {
                    whereValue = "''";
                } else if (StringUtils.containsIgnoreCase(f.getTerm(), "in")) {
-                    whereValue = "('" + StringUtils.join(f.getValue(), "','") + "')";
+                    whereValue = "('" + StringUtils.join(sanitizeSqlLiteral(f.getValue()), "','") + "')";
                } else if (StringUtils.containsIgnoreCase(f.getTerm(), "like")) {
-                    whereValue = "'%" + f.getValue() + "%'";
+                    whereValue = "'%" + sanitizeSqlLiteral(f.getValue()) + "%'";
                } else {
-                    whereValue = String.format(SQLConstants.WHERE_VALUE_VALUE, f.getValue());
+                    whereValue = String.format(SQLConstants.WHERE_VALUE_VALUE, sanitizeSqlLiteral(f.getValue()));
                }
                list.add(SQLObj.builder()
                        .whereField(fieldAlias)

Source: DataEase commit 4463e21. The patch routes each affected branch through sanitizeSqlLiteral() before building the WHERE clause.

Detection Methods for CVE-2026-55635

Indicators of Compromise

Chart definitions containing quota filter values with SQL metacharacters such as single quotes, --, UNION, or ;.
Datasource query logs showing unexpected statements originating from DataEase chart requests.
Chart data API requests with abnormally long or structured filter payloads referencing tables outside the chart's schema.

Detection Strategies

Inspect DataEase application logs for stack traces or SQL errors tied to Quota2SQLObj.getYWheres().
Enable query logging on datasources connected to DataEase and alert on statements that reference system tables or information_schema from the DataEase service account.
Review chart creation and update audit events for users who normally do not author charts.

Monitoring Recommendations

Correlate DataEase authenticated user activity with downstream datasource query patterns to identify anomalous joins or subqueries.
Alert on outbound datasource errors that spike after chart edits by low-privilege analyst accounts.
Track the running DataEase version and flag any deployment still below 2.10.24.

How to Mitigate CVE-2026-55635

Immediate Actions Required

Upgrade DataEase to version 2.10.24 or later, which routes quota filter values through sanitizeSqlLiteral().
Restrict chart creation and modification permissions to trusted users until the upgrade is complete.
Rotate credentials for any datasource that DataEase connects to using elevated privileges.

Patch Information

The fix is applied in commit 4463e21cb73d3d4bb8af89a0cb71ee403e4b808a and shipped in DataEase 2.10.24. See the GitHub Security Advisory GHSA-p758-rx6v-hc8g for vendor guidance and the upstream commit for code-level details.

Workarounds

Reduce datasource account privileges to read-only on the minimum set of tables required for reporting.
Place DataEase behind an authenticated reverse proxy and limit chart API endpoints to specific user groups.
Inspect and remove any suspicious chart definitions containing SQL metacharacters in quota filter values before upgrading.

bash

# Upgrade DataEase container to the patched release
docker pull dataease/dataease:v2.10.24
docker stop dataease && docker rm dataease
docker run -d --name dataease \
  -p 8100:8100 \
  -v /opt/dataease/data:/opt/dataease/data \
  dataease/dataease:v2.10.24