CVE-2026-104141

{
  "etk_id": "ETK-2026-2129",
  "cve_id": "CVE-2026-104141",
  "display_id": "CVE-2026-104141",
  "ghsa_id": "GHSA-8hgp-vw27-hxph",
  "euvd_id": "EUVD-2026-101608",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in DataEase datasource metadata handling",
  "summary": "DataEase versions before 2.10.26 are affected by SQL injection in datasource metadata operations. An authenticated user with datasource access can alter database queries executed with the application's configured datasource credentials, potentially affecting the connected database. Exploitation requires a valid login and access to datasource configuration or metadata flows.",
  "mitigation": "Upgrade io.dataease to version 2.10.26 or later. Restrict datasource configuration access to trusted users until the update is deployed.",
  "vendor": "maven",
  "product": "maven:io.dataease",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<2.10.26"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.10.26"
      ],
      "package_name": "io.dataease",
      "purl": "pkg:maven/io.dataease"
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0028,
  "epss_percentile": 0.1936,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 50.482913466666666,
  "t0_at": "2026-10-14T18:41:06.878000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-07-30T07:57:20+00:00",
      "days": -76.44707034722222,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:41:06.878000+00:00",
      "url": "https://github.com/dataease/dataease/security/advisories/GHSA-8hgp-vw27-hxph"
    },
    "trigger_signal": {
      "at": "2026-10-14T18:41:06.878000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:41:06.878000+00:00",
      "url": "https://github.com/dataease/dataease/security/advisories/GHSA-8hgp-vw27-hxph"
    }
  }
}