如果您发现安全问题，请直接联系我们：
- wei@fit2cloud.com
- support@fit2cloud.com
- 400-052-0755
感谢您的支持！
All security bugs should be reported to the contact as below:
- wei@fit2cloud.com
- support@fit2cloud.com
- 400-052-0755
Thanks for your support!
Repository navigation
Security: dataease/dataease
Security
SECURITY.md
-
Unauthenticated Arbitrary Class Loading via SQL Server socketFactoryClassGHSA-26fq-m9w8-pxq2 published
Sep 24, 2026 by xuwei-fit2cloudHigh -
SQL Injection in Datasource Metadata Identifiers (Incomplete Fix for GHSA-8hgp-vw27-hxph)GHSA-xcr3-p567-5c8c published
Sep 24, 2026 by xuwei-fit2cloudHigh -
Remote Code Execution via Unescaped Column Names in DDLGHSA-64vv-3552-hpcf published
Sep 24, 2026 by xuwei-fit2cloudCritical -
SQL Injection via dateFormat in DataEase (Bypass of GHSA-h32f-m89w-g35f)GHSA-mjc3-fv7f-qjmv published
Sep 24, 2026 by xuwei-fit2cloudHigh -
Ticket authorization bypass vulnerabilityGHSA-g85v-g7p5-j787 published
Sep 24, 2026 by xuwei-fit2cloudModerate -
Security Vulnerability in previewSql Endpoint for H2 Data SourcesGHSA-cf4w-7wqg-6rrh published
Aug 4, 2026 by fit2cloudrdHigh -
Remote Code Execution via H2 JDBC‑URL Injection (Blacklist Bypass) in DataEaseGHSA-h72x-2xr4-hv49 published
Jul 30, 2026 by xuwei-fit2cloudHigh -
Access Control Vulnerabilities in the Sharing Link Module of DataEaseGHSA-9h54-39gh-5qfg published
Jul 30, 2026 by xuwei-fit2cloudHigh -
Missing authorization checks in DataEase geographic information, linkage and chart APIsGHSA-494p-38q6-9gx5 published
Jul 30, 2026 by xuwei-fit2cloudHigh -
Stored SQL Injection via dateFormat field templatesGHSA-h32f-m89w-g35f published
Jul 30, 2026 by xuwei-fit2cloudHigh
Learn more about advisories related to dataease/dataease in the GitHub Advisory Database