CVE-2026-102756 dataease CVE debrief

Who should care

Defenders responsible for DataEase deployments, especially those where users can edit dataset fields and chart configurations, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-102756 is a stored XSS vulnerability in DataEase that allows authenticated users to execute JavaScript in a victim's session. Defenders should prioritize verifying exposure, assessing the feasibility of upgrading, and applying compensating controls.

• Execution of attacker-controlled JavaScript in a victim's DataEase session
• Potential for unauthorized actions within DataEase
• Need for verification of user input handling in chart configurations
• Prioritization of upgrading to version 2.10.26 or applying compensating controls

Technical summary

The vulnerability exists in DataEase versions prior to 2.10.26. Authenticated users with permission to edit dataset fields and chart configurations can store HTML-bearing dimension values in bar-horizontal charts. When the category axis label is truncated, the full label is retrieved and assigned to the g2-tooltip-title element through innerHTML, allowing an attacker to execute JavaScript in a victim's DataEase session.

Defensive priority

Defenders should prioritize verifying exposure in DataEase deployments, especially where users can edit dataset fields and chart configurations. They should also assess the feasibility of upgrading to version 2.10.26 or applying compensating controls to limit user input in chart configurations.

Recommended defensive actions

• Verify DataEase version and check if users can edit dataset fields and chart configurations
• Assess the feasibility of upgrading to version 2.10.26
• Consider applying compensating controls to limit user input in chart configurations
• Monitor for potential exploitation attempts
• Perform asset inventory of DataEase deployments
• Review rollback and change window procedures for DataEase updates
• Track source changes for DataEase vulnerability information

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in versions prior to 2.10.26 and the fix in version 2.10.26. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.