CVE-2026-123992 · Package
NO FIX YET · SEE WHAT TO DO
DataEase, a data visualization platform, fails to properly validate SVG files in its static resource handler, so a crafted SVG can run script in a victim's browser. The sources say an attacker can trigger it remotely and that a public exploit exists.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a self-hosted DataEase instance with version up to 2.10.27 and let users upload or view SVG files are exposed. The sources do not say whether a login is needed to reach the upload path, so treat any reachable instance as exposed. Instances already on 2.10.28 or later are not affected by this flaw.
Not affected if version-2.10.28-or-later
Who cares dataease, java, self-hosted
2.10.27.StaticResourceServer.java in core/core-backend/src/main/java/io/dataease/visualization/server/ to confirm the vulnerable code is present.2.10.28 (patch 0709fe98d6608c3507daee3e92cf433e7ff61370).A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 2.10.28 can resolve this issue. This patch is called 0709fe98d6608c3507daee3e92cf433e7ff61370. You should upgrade the affected component. The vendor confirms: "The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses."
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.