SQL injection in DataEase - #VU140507
Published: July 30, 2026
Vulnerability identifier: #VU140507
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
DataEase
DataEase
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary SQL.
The vulnerability exists due to SQL injection in datasource metadata identifier handling in CalciteProvider when processing datasource metadata requests with user-controlled schema names, usernames, or table or database names. A remote user can send a specially crafted datasource configuration request to execute arbitrary SQL.
The injected SQL is executed against the connected backend database using the application's stored datasource credentials during metadata checks.
Remediation
Install security update from vendor's website.