---
id: CVE-2026-50030
title: DataEase is an open source data visualization and analysis tool
summary: >-
  DataEase is an open source data visualization and analysis tool. Prior to
  2.10.23, DataEase SQL preview exposes
  DatasetDataApi.previewSql/previewSqlCheck through
  /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.da…
severity: none
cwe:
  - CWE-89
published: '2026-07-15'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50030'
references:
  - url: >-
      https://github.com/dataease/dataease/commit/22930a493d900fe3d8084b3dd4c0125abdb2a847
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/dataease/releases/tag/v2.10.23'
    label: security-advisories@github.com
  - url: >-
      https://github.com/dataease/dataease/security/advisories/GHSA-j4v5-5gcx-cvfc
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00467
epssPercentile: 0.37757
ingestedAt: '2026-07-18T15:23:42.597Z'
---

## Overview

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross, then DatasetDataManage.previewSql stores decoded SQL in datasourceRequest.query and CalciteProvider.fetchResultField executes it with prepareStatement(...).executeQuery(), allowing arbitrary readable datasource tables to be queried and returned in preview responses. This issue is fixed in version 2.10.23.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.