CVE-2026-55635

unknowncovered by 1 sourcefirst seen 2026-07-07

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres() without applying the SQL literal validation and escaping used by other filter paths, allowing an authenticated user who can create or modify chart definitions or submit chart data requests containing quota filters to inject SQL into queries executed against configured datasources. This issue is fixed in version 2.10.24.

⚡ Watch CVE-2026-55635

Get an email if CVE-2026-55635 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-55635: DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota…nvd · 2026-07-07

External references

NVD record for CVE-2026-55635

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55635 status](https://www.csirts.com/badge/CVE-2026-55635)](https://www.csirts.com/cve/CVE-2026-55635)