Description

A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic Map. Such manipulation of the argument canvasViewInfo[*].customAttr.tooltip.backgroundColor leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T15:16:28.820Z",
  "pubdate": "2026-09-13T15:16:28.820Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Symbolic Map component of DataEase, affecting versions up to 2.10.25 and 2.10.26.\nThe vulnerability originates from improper neutralization of user-supplied input within the tooltip configuration properties.\nA remote, unauthenticated or authenticated attacker can leverage this flaw to execute arbitrary JavaScript within the context of a victim's browser session.\nSuccessful exploitation permits the compromise of user sessions, including the theft of session tokens, cookies, or the unauthorized manipulation of the web interface displayed to the user.\nGiven that the vulnerability allows for client-side code execution, it poses a significant risk to the integrity and confidentiality of the application's user data.\nThe vulnerability is currently unpatched, and the project maintainers have not yet responded to disclosure reports.\nThe attack vector is remote, requiring the attacker to supply a malicious payload through the affected configuration parameter, which is subsequently rendered by the application frontend.",
  "technicalDetails": "The vulnerability is located in the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts, specifically within the buildTooltip function.\nThe root cause is the improper handling of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument. The application fails to perform adequate input sanitization or output encoding before rendering this property directly into the Document Object Model (DOM).\nIn the context of the Symbolic Map component, the buildTooltip function is responsible for dynamically generating tooltip elements for visual charts. By injecting malicious HTML or JavaScript sequences into the backgroundColor attribute field, an attacker can break out of the intended attribute context and execute arbitrary script code.\nThe attack flow proceeds as follows: 1) An attacker provides a maliciously crafted input string designed to terminate the attribute definition and inject a script element or event handler (e.g., '><script>alert(1)</script>'). 2) The application processes this input via the Symbolic Map component during the map rendering sequence. 3) The buildTooltip function processes the payload and injects it into the DOM of the victim's browser. 4) The browser executes the injected JavaScript code upon parsing the tooltip, leading to the XSS condition.\nThis vulnerability is classified as stored or reflected XSS depending on whether the malicious payload is persisted in the application's backend database or passed via a manipulated request.\nBecause the payload is processed at the frontend rendering stage, any user viewing the affected chart component is susceptible to the attack. The execution occurs within the origin of the DataEase application, granting the injected script full access to the Document Object, local storage, session storage, and cookies associated with the domain.\nThe impact is significant, as it enables session hijacking, defacement of the reporting dashboard, unauthorized data exfiltration, or the redirection of users to malicious external domains. Since the buildTooltip function does not implement a content security policy (CSP) or utilize context-aware output encoding to neutralize the input, the browser treats the malicious payload as trusted code.\nThere are no specific privilege requirements for triggering the rendering process if the chart is accessible to a user, though the ability to modify the canvasViewInfo object is typically required to initiate the attack."
}