CVE-2026-108824

6.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-74, CWE-89

Impact

Authenticated attackers can run arbitrary SQL commands against the database with network access to DataEase. A public exploit is available.

Root cause

The Utils.buildCalcField function in Utils.java fails to sanitize calculated field arguments before embedding them in SQL queries.

Affected systems

DataEase up to 3.0.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Apply commit 8509e218e6c1f0080eee9e379f269b2104785ef7 from PR #19285 or update to the patched release. If patching immediately is not possible, restrict network access to trusted authenticated users.

shell

$ git cherry-pick 8509e218e6c1f0080eee9e379f269b2104785ef7

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108824