CVE-2026-90529: DataEase Symbolic Map XSS Vulnerability

CVE-2026-90529 Overview

CVE-2026-90529 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting DataEase versions up to 2.10.25/2.10.26. The flaw resides in the buildTooltip function within core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts, part of the Symbolic Map component. Attackers can manipulate the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument to inject script content that executes in a victim's browser session. The attack is exploitable remotely and requires low privileges plus user interaction. The DataEase project was notified through a public issue report but has not responded at the time of disclosure.

Critical Impact
Authenticated remote attackers can inject arbitrary JavaScript into DataEase dashboards via the Symbolic Map tooltip background color parameter, enabling session theft, credential harvesting, and actions performed in the context of other users.

Affected Products

DataEase 2.10.25
DataEase 2.10.26
DataEase Symbolic Map component (symbolic-map.ts)

Discovery Timeline

2026-09-13 - CVE-2026-90529 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90529

Vulnerability Analysis

The vulnerability exists in the frontend rendering logic of DataEase's Symbolic Map chart component. The buildTooltip function constructs HTML tooltip markup using values sourced from chart configuration data. Specifically, the backgroundColor property under canvasViewInfo[*].customAttr.tooltip is inserted into the rendered tooltip without proper sanitization or output encoding.

Because the value is treated as trusted styling data rather than user-controlled input, malicious payloads escape the intended CSS context and are interpreted as executable markup. Any user who opens a dashboard containing a tampered Symbolic Map triggers script execution in their browser under the DataEase origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The buildTooltip function concatenates configuration values into HTML without validating that backgroundColor conforms to a safe color format such as a hex code, rgb(), or named color. This design assumes chart configuration originates from trusted authors, but DataEase permits multiple low-privilege users to author or modify visualizations.

Attack Vector

An authenticated attacker with permission to create or edit dashboards submits a crafted backgroundColor value containing HTML or JavaScript payload characters. When a victim opens the affected dashboard and interacts with the Symbolic Map (hovering to display tooltips), the injected payload executes. Exploitation requires network access to the DataEase instance, low privileges, and user interaction to trigger the tooltip render.

The vulnerability was described publicly through GitHub Issue #18846 and cataloged in VulDB CVE-2026-90529. No verified proof-of-concept code has been released.

Detection Methods for CVE-2026-90529

Indicators of Compromise

Dashboard configuration payloads where canvasViewInfo[*].customAttr.tooltip.backgroundColor contains characters such as <, >, ", ', or the strings script, onerror, or javascript: rather than a valid CSS color value.
Unexpected outbound requests from user browsers to attacker-controlled domains after loading Symbolic Map dashboards.
Audit log entries showing modifications to Symbolic Map chart configurations by low-privilege accounts.

Detection Strategies

Inspect stored dashboard JSON in the DataEase database for non-conforming backgroundColor values that do not match a strict color-format regular expression.
Enable browser Content Security Policy (CSP) reporting to surface inline script execution and blocked resource loads on DataEase pages.
Correlate authentication logs with dashboard-edit events to identify suspicious accounts modifying map components.

Monitoring Recommendations

Alert on DataEase HTTP responses containing tooltip markup with embedded HTML tags in style attributes.
Monitor the DataEase GitHub repository and VulDB entry for patch commits addressing symbolic-map.ts.
Track user-agent anomalies and session token reuse that may indicate cookie theft resulting from successful XSS execution.

How to Mitigate CVE-2026-90529

Immediate Actions Required

Restrict dashboard authoring permissions to trusted users until an official patch is available.
Review existing Symbolic Map configurations for anomalous backgroundColor values and remove any that do not represent valid CSS colors.
Deploy a strict Content Security Policy on the DataEase frontend to block inline script execution and untrusted external resources.
Rotate session tokens and credentials for any account that may have viewed a suspicious Symbolic Map dashboard.

Patch Information

At the time of publication, the DataEase project has not issued a patched release. Track the DataEase GitHub repository and the associated issue #18846 for remediation progress. Apply the vendor fix immediately once released.

Workarounds

Temporarily disable or hide Symbolic Map components in shared dashboards until a fix is available.
Enforce input validation at a reverse proxy or Web Application Firewall (WAF) layer to reject dashboard API payloads whose backgroundColor fields do not match a strict color-value pattern.
Segment the DataEase instance behind SSO with strong multi-factor authentication to limit which accounts can author charts.
Educate dashboard consumers to avoid interacting with untrusted or newly modified visualizations pending validation.

bash

# Example WAF rule pseudocode: reject dashboard save requests
# containing non-color values in tooltip.backgroundColor
SecRule REQUEST_BODY "@rx \"backgroundColor\"\s*:\s*\"[^\"]*[<>\"'\\(\\)][^\"]*\"" \
    "id:1029001,phase:2,deny,status:400,\
    msg:'Potential XSS in DataEase Symbolic Map backgroundColor (CVE-2026-90529)'"