CVE-2025-62422: Dataease

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in version 2.10.14. No known workarounds exist.

Affected products

• Dataease Dataease: before 2.10.14 (fixed in 2.10.14)

Published 2025-10-17. Last modified 2026-06-17.