CVE-2026-55647: DataEase Dashboard XSS Vulnerability

CVE-2026-55647 Overview

CVE-2026-55647 is a stored Cross-Site Scripting (XSS) vulnerability in DataEase, an open source data visualization and analysis tool. Dashboard text components render stored component content through the Vue v-html directive without server-side HTML sanitization. An authenticated user with permission to edit dashboard component data can inject HTML containing executable event handlers. The payload executes in the browser of any other user or shared-link visitor who views the affected dashboard. The issue is tracked as [CWE-79] and is fixed in DataEase version 2.10.24.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victims' browsers, enabling session theft, dashboard tampering, and pivoting through shared dashboard links.

Affected Products

DataEase versions prior to 2.10.24
Dashboard v-text custom component
Dashboard scroll-text custom component

Discovery Timeline

2026-07-07 - CVE-2026-55647 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55647

Vulnerability Analysis

DataEase dashboards support text-based custom components that display user-provided content. The frontend rendered this stored content using Vue's v-html directive, which binds raw HTML into the DOM without escaping. Because the server never sanitized the incoming HTML, any markup persisted through the dashboard editor was later returned verbatim to viewers. Attackers with edit permissions on a dashboard component could store HTML containing event handler attributes such as onerror, onload, or onmouseover. When another authenticated user or a shared-link visitor opened the dashboard, the browser executed the attacker's JavaScript in the victim's session context.

The issue affected two frontend components identified in the security patches: core/core-frontend/src/custom-component/v-text/Component.vue and core/core-frontend/src/custom-component/scroll-text/Component.vue. Because DataEase dashboards are frequently distributed through shared public links, the exploit surface extends beyond authenticated users.

Root Cause

The root cause is unsafe rendering of persisted user input. Vue's v-html directive is documented as unsafe for untrusted content, yet the affected components applied it directly to text stored in the visualization store. No server-side sanitization was performed on ingestion, and no client-side sanitization was applied before binding.

Attack Vector

Exploitation requires an authenticated account with dashboard edit rights. The attacker injects an HTML payload with event handlers into a text component, saves the dashboard, and waits for another user or shared-link visitor to render the view. The JavaScript then runs with the victim's privileges.

text

// Patch: sanitizeHtml import added to scroll-text/Component.vue
 import { toRefs } from 'vue'
 import { dvMainStoreWithOut } from '@/store/modules/data-visualization/dvMain'
 import { storeToRefs } from 'pinia'
+import { sanitizeHtml } from '@/utils/utils'
 
 const canEdit = ref(false)
 const ctrlKey = ref(17)
// Source: https://github.com/dataease/dataease/commit/adab5f1e8954ff91830a3b2f052a42a139d978e1

The patch introduces a sanitizeHtml utility that filters HTML before v-html binding. A companion commit removes the unused v-text Attr and Component files, eliminating the vulnerable render path entirely. See the GitHub Security Advisory GHSA-4v63-24fg-pfg7 for the full disclosure.

Detection Methods for CVE-2026-55647

Indicators of Compromise

Dashboard text component content containing HTML event handler attributes such as onerror=, onload=, onmouseover=, or <script> tags.
Unexpected outbound HTTP requests from browsers rendering DataEase dashboards, particularly to attacker-controlled domains.
Modifications to v-text or scroll-text component payloads by non-administrative accounts in DataEase audit logs.

Detection Strategies

Inspect DataEase database tables that store dashboard component payloads for HTML tags or JavaScript URI schemes (javascript:).
Review web server access logs for shared-link dashboard views followed by anomalous cross-origin requests.
Correlate dashboard edit events with subsequent authentication anomalies for viewers of the same dashboard.

Monitoring Recommendations

Enable and centralize DataEase application audit logs to track component edits by user and timestamp.
Deploy Content Security Policy (CSP) reporting to capture inline script or event-handler violations on DataEase dashboard pages.
Monitor for session cookie exfiltration patterns originating from browsers that recently viewed shared DataEase links.

How to Mitigate CVE-2026-55647

Immediate Actions Required

Upgrade DataEase to version 2.10.24 or later without delay.
Audit existing dashboards for stored HTML in text and scroll-text components and remove any untrusted markup.
Rotate session tokens and API keys for users who may have viewed dashboards edited by untrusted accounts.
Restrict dashboard editing permissions to trusted users until the upgrade is verified.

Patch Information

The vulnerability is fixed in DataEase 2.10.24. Two upstream commits address the flaw: commit adab5f1e adds sanitizeHtml to the scroll-text component, and commit 95658129 removes the vulnerable v-text component files.

Workarounds

If immediate upgrade is not possible, disable shared-link dashboard access to limit exposure to unauthenticated viewers.
Revoke dashboard edit privileges from all but a small set of vetted administrators.
Place DataEase behind a web application firewall configured to strip HTML event handler attributes from dashboard component API requests.

bash

# Verify DataEase version after upgrade
docker exec -it dataease cat /opt/dataease/conf/version.txt

# Expected output:
# 2.10.24 or later