CVE-2026-45534

UNKNOWN 0.0

DataEase: RCE Vulnerability

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase Redshift datasource connections can load attacker-controlled rsjdbc.ini configuration from System.getProperty("java.io.tmpdir"), setting socketFactory=org.springframework.context.support.FileSystemXmlApplicationContext so com.amazon.redshift.Driver#connect, com.amazon.redshift.Driver#getJdbcIniFile, and com.amazon.redshift.util.ObjectFactory#instantiate execute a reflection-based remote code execution chain during a normal JDBC connection through io.dataease.datasource.type.Redshift. This issue is fixed in version 2.10.23.

CWE	CWE-94
Vendor	dataease
Product	dataease
Published	Jul 15, 2026
Last Updated	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for dataease dataease

Be the first to know when new unknown vulnerabilities affecting dataease dataease are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

dataease / dataease

< 2.10.23

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dataease/dataease/security/advisories/GHSA-cv4c-8rpv-2x97 github.com: https://github.com/dataease/dataease/commit/3e58149f1e014b1a7ae2c12134b37ae438f676ac github.com: https://github.com/dataease/dataease/releases/tag/v2.10.23