High severity · published Jul 7, 2026
CVE-2026-53751
DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)
8.7
CVSS
0.6%
EPSS
No
On KEV
Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous parameters such as init in malicious H2 JDBC connection strings and achieve arbitrary code execution. This issue is fixed in version 2.10.24.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
dataease · dataease
< 2.10.24 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53751
github.com
https://github.com/dataease/dataease/commit/2204258118eac6160a6636ca20dbedb0d3f95747
github.com
https://github.com/dataease/dataease/releases/tag/v2.10.24
github.com
https://github.com/dataease/dataease/security/advisories/GHSA-xjhm-r8p8-c2cg
More from dataease
9.8
CVE-2026-33122
DataEase has SQL Injection via Datasource Management
9.8
CVE-2026-33082
DataEase: SQL Injection in v2 Dataset Export
9.8
CVE-2026-23958
DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
9.8
CVE-2025-64428
DataEase DB2 JNDI Vulnerability
9.8
CVE-2025-64164
DataEase is vulnerable to Oracle JNDI Injection