Cross site scripting in DataEase SVG handler
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.
Summary
DataEase versions up to 2.10.27 contain a cross site scripting flaw in the SVG handler, where the function StaticResourceServer.validateSvgContent fails to neutralize input in SVG content (CWE-79). A remote attacker with no privileges needs a user to interact with crafted SVG content, which can run script in that user's browser. The exploit has been published and may be used.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 2.10.28 can resolve this issue. This patch is called 0709fe98d6608c3507daee3e92cf433e7ff61370. You should upgrade the affected component. The vendor confirms: "The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses."
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | DataEase | 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 2.10.11; 2.10.12; 2.10.13; 2.10.14; 2.10.15; 2.10.16; 2.10.17; 2.10.18; 2.10.19; 2.10.20; 2.10.21; 2.10.22; 2.10.23; 2.10.24; 2.10.25; 2.10.26; 2.10.27 | 2.10.28 | Patch available | CNA |
- DataEase Vendor— Affected 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 2.10.11; 2.10.12; 2.10.13; 2.10.14; 2.10.15; 2.10.16; 2.10.17; 2.10.18; 2.10.19; 2.10.20; 2.10.21; 2.10.22; 2.10.23; 2.10.24; 2.10.25; 2.10.26; 2.10.27 Fixed in 2.10.28 Patch available CNA
Remediation
Upgrade DataEase to version 2.10.28, which contains the fix (commit 0709fe98d6608c3507daee3e92cf433e7ff61370).
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
- Fix · CNA DataEase Fixed in 2.10.28
Timeline
- 2026-11-07 Threatist record created from CVE-2026-123992
- 2026-11-07 Alias added: GHSA-53pr-f2w2-phx8
References
Sources
- CVE-2026-123992 · CVE Program
- CVE-2026-123992 · NVD
- GHSA-53pr-f2w2-phx8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences