CVE-2026-104143

{
  "etk_id": "ETK-2026-1602",
  "cve_id": "CVE-2026-104143",
  "display_id": "CVE-2026-104143",
  "ghsa_id": "GHSA-h32f-m89w-g35f",
  "euvd_id": "EUVD-2026-101556",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored SQL injection in DataEase date format handling",
  "summary": "DataEase versions before 2.10.26 allow authenticated users to save a malicious custom date format for a dataset field. When an affected field is rendered in a chart, the stored value may alter generated SQL and compromise the confidentiality, integrity, or availability of the backend database; cross-datasource datasets are specifically affected.",
  "mitigation": "Upgrade DataEase to version 2.10.26 or later. Until upgrading, restrict untrusted users from creating or modifying dataset field date formats and limit access to affected chart and dataset configuration features.",
  "vendor": "dataease",
  "product": "dataease",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<2.10.26"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.10.26"
      ],
      "package_name": "io.dataease",
      "purl": "pkg:maven/io.dataease"
    }
  ],
  "cwes": [
    289
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.1719,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 56.4925538,
  "t0_at": "2026-10-14T18:43:34.275000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T18:43:34.275000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:43:34.275000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104143"
    }
  }
}