CVE-2025-64428

Published November 20th, 2025

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

dataease/dataease

🔥 人人可用的开源 BI 工具，数据可视化神器。An open-source BI tool alternative to Tableau.

GitHub

24K