CVE-2026-104142

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104142
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104142.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104142
Aliases
  • GHSA-gcr3-cj2q-gj4q
Published
2026-10-14T18:42:36Z
Modified
2026-10-28T10:45:59Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
DataEase: Stored SQL Injection in group-field binning bounds
Details

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field. This stored SQL injection can compromise the confidentiality, integrity, and availability of the configured backend database. This issue is fixed in version 2.10.26.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104142.json"
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
04129b006b2a51447fb15f5c32138f39a4fd4fec
Fixed
59191a17657b75d0721e428c10bc0065c3310b17
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.10.26"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "59191a17657b75d0721e428c10bc0065c3310b17"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.10.26",
            "range": [
                {
                    "fixed": "04129b006b2a51447fb15f5c32138f39a4fd4fec"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.10.0
v2.10.1
v2.10.10
v2.10.11
v2.10.12
v2.10.13
v2.10.14
v2.10.15
v2.10.16
v2.10.17
v2.10.18
v2.10.19
v2.10.2
v2.10.20
v2.10.21
v2.10.22
v2.10.23
v2.10.24
v2.10.25
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.10.7
v2.10.8
v2.10.9
v2.2.0
v2.3.0
v2.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104142.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "248434368392333239084712132942048475194",
            "length": 2965
        },
        "id": "CVE-2026-104142-c9e1eb7f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/59191a17657b75d0721e428c10bc0065c3310b17",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/engine/utils/Utils.java",
            "function": "transGroupFieldToSql"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "253303402679150235015875625366249723426",
                "81558088375556630350714700106607674134",
                "50394833190149197246362695864497890185",
                "310274041521895949789585373228407181908",
                "116039819248862648018841363971863831412",
                "195166170500575804354361348431059063854",
                "186560664356742607505417032781664109593",
                "11555455672003497271382151181724050082"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-104142-dd95cefc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/59191a17657b75d0721e428c10bc0065c3310b17",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/engine/utils/Utils.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:45:59Z"