CVE-2026-55647

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55647

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55647.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55647

Aliases

GHSA-4v63-24fg-pfg7

Published

2026-07-07T20:37:54.884Z

Modified

2026-07-15T01:49:12.818565328Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

DataEase: authenticated stored XSS in the dashboard text components

Details

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable event handlers that execute when another user or shared-link visitor views the dashboard. This issue is fixed in version 2.10.24.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55647.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type

GIT

Repo

https://github.com/dataease/dataease

Events

Introduced

Fixed

9565812980da781eda04c0a3632bf5dc8b0469f6

Fixed

adab5f1e8954ff91830a3b2f052a42a139d978e1

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.24"
        }
    ]
}

Affected versions

v1.*

v1.0.0

v2.*

v2.2.0

v2.3.0

v2.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55647.json"