DataEase SQL Injection CVE-2026-104143 Patched in Version 2.10.26

DataEase has released version 2.10.26 to address a high-severity SQL injection vulnerability identified as CVE-2026-104143. This flaw allows authenticated users to manipulate backend database queries by inserting malicious code through custom date formatting settings.

What happened

The vulnerability exists in DataEase versions prior to 2.10.26, an open-source data visualization and analysis tool. According to the National Vulnerability Database record, authenticated users can store a crafted custom dateFormat for a dataset field. The application inserts this value without validation into date conversion templates used by several internal components.

These components include Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the affected field on a cross-datasource dataset, the application bypasses Calcite parsing. This bypass allows the crafted format to directly alter the generated SQL statements.

On single-datasource datasets, exploitation is more constrained. The payload must survive Calcite reserialization as a valid string literal to succeed. Despite this constraint, successful exploitation can compromise the confidentiality, integrity, and availability of the backend database. The issue is rated CVSS 8.7 HIGH.

Why it matters

This flaw maps to CWE-289, which covers authentication issues, though the primary impact here is SQL injection via unvalidated input. The ability to alter SQL generation directly threatens the core data integrity of the visualization tool. Attackers with valid accounts can potentially read, modify, or delete data in the connected databases.

The risk is elevated because the attack vector requires only an authenticated user, not remote anonymous access. Many organizations grant broad access to data visualization tools for reporting purposes. This increases the pool of potential attackers who could trigger the vulnerability.

The fix in version 2.10.26 adds necessary validation to the DatasetTableFieldDTO.dateFormat field. This prevents the insertion of malicious code into the SQL generation process. Organizations running older versions remain exposed to this database-level compromise risk.

What to watch

• Monitor for unusual SQL query patterns in backend database logs.
• Review access logs for authenticated users creating or modifying custom date formats.
• Check for unexpected changes in data integrity or availability on connected databases.
• Verify that all instances are running version 2.10.26 or later.

Who needs to act first

Teams should prioritize updating systems that connect to sensitive or production databases. Start with instances that have broad user access, as any authenticated user can trigger the flaw. Test the update in a non-production environment first to ensure compatibility with existing dashboards and data sources. Back up configuration files and database connections before applying the patch. If immediate patching is not possible, restrict the ability to create custom date formats to trusted administrators only. Monitor database performance for signs of injection attempts.

What to do and how to stay safe: DataEase

• Update all DataEase instances to version 2.10.26 or later to apply the security fix.
• Audit user permissions to ensure only necessary personnel can modify dataset field formats.
• Review database logs for any evidence of SQL injection attempts or unauthorized data access.
• Implement network segmentation to limit the impact of a compromised visualization tool on critical databases.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-104143?

It is a high-severity SQL injection vulnerability in DataEase versions prior to 2.10.26 that allows authenticated users to alter SQL generation via crafted date formats.

Which versions of DataEase are affected?

All versions of DataEase prior to 2.10.26 are affected by this vulnerability.

Is there a fix available?

Yes, the issue is fixed in DataEase version 2.10.26.