{"id":"CVE-2026-45320","summary":"DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection","details":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace(\"${var}\", value) splices it into dashboard SQL, allowing authenticated users who can view a dashboard to inject SQL against integrated datasources. This issue is fixed in version 2.10.23","aliases":["GHSA-8vp9-9hx4-6458"],"modified":"2026-08-12T16:24:35.814685Z","published":"2026-07-15T19:40:28.311Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45320.json"},"references":[{"type":"WEB","url":"https://github.com/dataease/dataease/releases/tag/v2.10.23"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45320.json"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/security/advisories/GHSA-8vp9-9hx4-6458"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45320"},{"type":"FIX","url":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dataease/dataease","events":[{"introduced":"0"},{"fixed":"163d510c6935a4010727392f5a680a7dc15abb13"},{"fixed":"cd4844cc45049e73a53d65e3a58454a167a3dffb"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.10.23"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.10.22","v2.10.21","v2.10.20","v2.10.19","v2.10.18","v2.10.17","v2.10.16","v2.10.15","v2.10.14","v2.10.13","v2.10.12","v2.10.11","v2.10.10","v2.10.9","v2.10.8","v2.10.7","v2.10.6","v2.10.5","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.6.0","v2.3.0","v2.2.0","v1.0.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/line/LineHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"length":1673,"function_hash":"338567924252454241049062529092990709593"},"id":"CVE-2026-45320-03ee1907"},{"digest":{"function_hash":"141385276248948159939386459716556132056","length":1463},"id":"CVE-2026-45320-0dc3f1f1","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/commons/utils/DeSqlparserUtils.java","function":"transFilter"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/commons/utils/DeSqlparserUtils.java","function":"handleVariableDefaultValue"},"deprecated":false,"digest":{"function_hash":"214194757906860487050520768283576752332","length":3954},"id":"CVE-2026-45320-1514c464","signature_type":"Function"},{"digest":{"line_hashes":["261236070576652220946764524042390711888","8416144773828899743018209536712767808","56400381638992486365054270138904392516","132950895353837373950095529978835133862","314768328130780554667996853824180700649"],"threshold":0.9},"id":"CVE-2026-45320-20d33eeb","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/line/StackAreaHandler.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"334680160032490272216799583329360456297","length":3220},"id":"CVE-2026-45320-211eb909","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/commons/utils/SqlparserUtils.java","function":"handleVariableDefaultValue"}},{"digest":{"line_hashes":["14976243502146607647771885108180968339","38804551854486466634454750266173226908","118965973651184003995497546791363184228","126766184909484436520192617199288803406","307312445851575777738740055050875686220","325055417181018511298919938368612737547"],"threshold":0.9},"id":"CVE-2026-45320-227ac100","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TableHeatmapHandler.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/dataset/manage/DatasetSQLManage.java","function":"getUnionForEdit"},"deprecated":false,"digest":{"function_hash":"289641109441183443892832644032846953063","length":2130},"id":"CVE-2026-45320-30649f7e","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"223955872954944342004372027140219438475","length":3306},"id":"CVE-2026-45320-30b1e5d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"function":"calcChartResult","file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/map/SymbolicMapHandler.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/dataset/manage/DatasetSQLManage.java","function":"getUnionTable"},"deprecated":false,"digest":{"function_hash":"170208478197109495152755639830754750225","length":1292},"id":"CVE-2026-45320-344932f3"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/mix/MixHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"194558229572316261950334016194191551910","length":5147},"id":"CVE-2026-45320-44c63ec6"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TablePivotHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["144696682310426329521776157993337535144","8416144773828899743018209536712767808","56400381638992486365054270138904392516","132950895353837373950095529978835133862","314768328130780554667996853824180700649","255931845812925473429694374471951855677","261960470072650685972763189690204167424","331456831161222710732365986078213644263","186356101745225170248180812278693247802","240887898973502460098144337264851656782","76851812836155851323735448800788697237","93888950784612455269391827478000969060","105984266091386007868516913016340043540","44765303609850472896098225471969098687","13157309823205806826604563248387407938","109075041784215891454153541374970556557","8038776209558298792231037755333826950","176954207143998314494747902103934526534","260785898000051864716572854603644998775","78618383727881524638379597402566605566","264101221016891471307051479420925155622","44765303609850472896098225471969098687","13157309823205806826604563248387407938","109075041784215891454153541374970556557","8038776209558298792231037755333826950","161007858198378519487617116045061855559","124170515447659164382779831196018430795","160413954712175551348698576783039373195","60955600619338987986044253089607686421","304842966871088333104155266259851798538","49541160194968341734085583174802732164","158087924807834781043321827027521058559","8038776209558298792231037755333826950","339439630844218728932666837126847886915","121564798301783198835128989244946564165","246221529264383971728424289781583681109","8038776209558298792231037755333826950","258048777023677136638853108181275195419","259117859005015012113394596267848976882","254965679170681896823831385576361708574","338078307547066919156694230891338923380","74770580600126765557080878735373349024","30470074862254017657952567449071517358","136025925643438184720033964706800855260","28983647767180349076607084189708864545","163054893550400046504081773879675692941","143409633773650293811029458565623063226","249519619448669727119319053694809129804"]},"id":"CVE-2026-45320-4880f335"},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/scatter/MultiScatterHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"113595592440303857344806859615925064384","length":1555},"id":"CVE-2026-45320-52de9565","signature_type":"Function"},{"target":{"file":"core/core-backend/src/main/java/io/dataease/dataset/manage/DatasetSQLManage.java"},"deprecated":false,"digest":{"line_hashes":["118200313628890920244769511304048960837","112841653409549329724280076269454392497","261333664782851275847929035710086082300","99599802013518293171021355874992175314","174405595947257729448867988041894237593","70229210568760717767949382602703079111","294283850891900472598633111494330755088","264429371652488068243050136069254824148","78798164647821195859153774204952577184","243706432729542123356920767423196918998","86514172063597392420164928189775546866","78168548422628034471134162939370171555","172179784257595106268492185953292255022","140399955922509056723671226093563444928","93798694212575573877115571510617358176","116880150753238858850491403575072774026","24131404051334657597177762342321697347","189351922817928854885779128966393329731","279333124338201247157904960787083126315","283666465333322396396581685365233882343","28629090547395309256186828556803632285","66409150451872941384276958697755663701","193909118789254614888755581524309685780","67571271451093454885130299816873549735","127717634319007064027165452256883259644","104763361200191012016320237792335199629","8019023084556441027375351437803566237","282034649488468574847893217397872792030","173179605300068731815174828211012590402","244497807398686812494288950617380310242","77646440445210520969175147378541121026","75130203522227420530022824655995964912","139911162528096101055409797341626455802","14986851379939814893758086714018422511","279333124338201247157904960787083126315","332356653487603688288445044698571319089","195177385973157638211996971501551337271","39376502025388838263076703117712555169","185035870603862492114452137090924990475","8598455564186878787973886382419913838","27390470696605875320121172821259745552","104736903971364437863021863163347028654","204255788290978432999377685116531949086","168642644148532461578482932528229993534"],"threshold":0.9},"id":"CVE-2026-45320-5f1e7605","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13"},{"target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/YoyChartHandler.java"},"deprecated":false,"digest":{"line_hashes":["165892329345602271595903666241178331202","78481157992636703090867331487373183567","325363442778649103826044870933111886101","94769002154319476888703743894281585070","192285415366035471739741702659864833400"],"threshold":0.9},"id":"CVE-2026-45320-621b292d","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13"},{"target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TableNormalHandler.java"},"deprecated":false,"digest":{"line_hashes":["77226269970031973483902280013170846605","125005243277463591704598944728896343723","167513501527529990644969643232288046015","324616011796628010482741831054901375939","307312445851575777738740055050875686220","266593975570046187569157577368646485216","3930112959596739781679301924997882251","108059791059734507449382854496732286305","103137465022816362891335100465377192416","86290774984678868487165064519933604834","282840328341264705056576142667503210962","8416144773828899743018209536712767808","56400381638992486365054270138904392516","132950895353837373950095529978835133862","314768328130780554667996853824180700649","322374949792801862207850074513571537649","193028608079056424576095149942984739795","90942024933680348304935557959629546362","250513377719809565346054238563765712838","36161818905014117051329292279530173039"],"threshold":0.9},"id":"CVE-2026-45320-6c2a3ab4","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13"},{"source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/DefaultChartHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"128432637511558422154222840950508656580","length":1819},"id":"CVE-2026-45320-6f5ef636","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/line/LineHandler.java"},"deprecated":false,"digest":{"line_hashes":["261236070576652220946764524042390711888","8416144773828899743018209536712767808","56400381638992486365054270138904392516","132950895353837373950095529978835133862","314768328130780554667996853824180700649"],"threshold":0.9},"id":"CVE-2026-45320-705a29ce"},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/commons/utils/SqlparserUtils.java"},"deprecated":false,"digest":{"line_hashes":["169279030762016509075069182702824267625","160734463550684663804084704187036593870","278548163906911122525105326814795969818","186580344544812758372195220092115162022","163041301278342156184975867657963128924","233621932241023841143735584750658376593","318544673122946230629055640055870412179","307201201630942034809726038408603693725","254304779858692436357518794731233697826","180420058783305637677302230290048919098","12917539375348615356553757149136019956","44211751682858351515795739111940163744","271101287437217976868582569922111253504","215026709897335671469021059680334031086","37094907840854079986070775961499149968","198716904770336057344461146983390155234","65846199765978363202520730811269503949","206456420626484771567431694792891855862","148681443743398391622222797374899649716","259147594479552651852083994981743483726","185039076920468787225690327797849157169","151626802682310891527628448812921698542","60572497015085501644757163044246048835","92490058189916725993474429435549270504","177582469167817386918943996089949672963","85169922957805707832875143978139200298","195663903516107986593926803030430035517","267866253505922936528088768797464789462","65166493213226063288635020421376929241","269669861593541919104571991100903262267","178553971416540695499226250555219296306","62633711428356289019068935162046391520","268433838785850067481594223090417091913","203301394663457516374849135715433641812","288970138335416434037926437280312928850","72642336572214532763915532981122998119","63300358893352895371255501091631083427","131931913865056587094979111386489809988","242582212459999322959658379853534823978","155265247077452315105761978301719408974","162785847779474705740151310348395825362","309187086838188572391333269106570419170","86883331155412731346408429427995965042","116724366233169747463587419900590811654","128216957687510413882401472155170673545","161415633850188568334863667649519207719","49158860407044152330371508254787523635","257422162120716484981884949448351389678","221666278650561887282602146706431584408","136106614441140130725406173478561396404","108587633537507210242609878158511307392","108587633537507210242609878158511307392","76057514354772284463525610455852080436","224185541206453269753712848353858847701","79799918327550831139217160669498358605","191262707915280288200238121101863206237","167520643009321846810757786696483143990","217859012421623317712915006029926486566","211087884657899961615961238361830605408","214979912837948450078813813026230382978","152287853613977579837773112709175697104","246882892402176037327995330761323053364","259163270393621789795820157520172241039","326133899466356534920173740674091406226","145453700923183094259087644739165758196","136667801363474451697171120113511110372","114216053417171920856345641382372312152","323763977828970817625658005641848835850","233018204385839075765538413613135677263","279226626073256805613729974880683103678","223235519646683032593694410353412231439","218087211365491836042535783666485289793","22138089143179663118874533409485816176","58709740926574183794898264427983753185","142331792310711333783213960756411642071","30373951224593748408853535471019932462","228674077855244686721525454282226013596","56182063040452106116662867335728546866","336895996550068852232931455061167618481","223778580507869872022923482901384618659","8656345438210537153822114352288718778","37806550738642808638811580504913486185","275833832887782809887874483761204368250","137093810132186261313162027310026417287","322748410985940767416611765941064118919","285241813174993094949937567352645798015","277934281842988826878601678399076203881","246359006005582844220797817391690322254","103270659362699006580646873564047033094","184694671041140178436807423678284626946","127397705204516677722213704934280652441","196562493715153929995556854236580386417"],"threshold":0.9},"id":"CVE-2026-45320-72ca5062","signature_type":"Line"},{"source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/scatter/MultiScatterHandler.java"},"deprecated":false,"digest":{"line_hashes":["242840594437038528370524577953754403053","125005243277463591704598944728896343723","167513501527529990644969643232288046015","324616011796628010482741831054901375939","307312445851575777738740055050875686220","4787257910064937921068180155262532257"],"threshold":0.9},"id":"CVE-2026-45320-73a580d3","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TableInfoHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"130754768497143185456142401016557393617","length":7217},"id":"CVE-2026-45320-73ac107d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/numeric/NumericalChartHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"69235960283498023404914291311176306674","length":1501},"id":"CVE-2026-45320-7af4a366"},{"deprecated":false,"digest":{"line_hashes":["77226269970031973483902280013170846605","125005243277463591704598944728896343723","167513501527529990644969643232288046015","289149366321246717247157097142170811045","30719531360295272678183015824697771645","88741437424880210513876806100455585912","253534273219613143069502468327822841370","324974387177751861780767544331019772505","314768328130780554667996853824180700649","322374949792801862207850074513571537649","193028608079056424576095149942984739795","90942024933680348304935557959629546362","250513377719809565346054238563765712838","36161818905014117051329292279530173039"],"threshold":0.9},"id":"CVE-2026-45320-7b398428","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TableInfoHandler.java"}},{"deprecated":false,"digest":{"function_hash":"68873614788631058819924081990100985426","length":1121},"id":"CVE-2026-45320-7cdd04ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/bar/BulletGraphHandler.java","function":"calcChartResult"}},{"deprecated":false,"digest":{"function_hash":"89829119637392646433066433375003716240","length":2007},"id":"CVE-2026-45320-8191ea9b","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TablePivotHandler.java","function":"calcChartResult"}},{"source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/commons/utils/SqlparserUtils.java","function":"transFilter"},"deprecated":false,"digest":{"length":1463,"function_hash":"141385276248948159939386459716556132056"},"id":"CVE-2026-45320-89540811","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/DefaultChartHandler.java"},"deprecated":false,"digest":{"line_hashes":["209292963457385366406221834526539915324","49577487325108300084319630429867240902","224442814496807938698587854357136353886","142589827751355628401182462391577388947","262486270366756548170677720481761665472","309537369105567176255061812213659364889","303956879426414980745489180246829552398","242840594437038528370524577953754403053","125005243277463591704598944728896343723","167513501527529990644969643232288046015","324616011796628010482741831054901375939","307312445851575777738740055050875686220"],"threshold":0.9},"id":"CVE-2026-45320-89a8bddd"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TablePivotHandler.java","function":"getData"},"deprecated":false,"digest":{"function_hash":"72726909362264094723361802374447736381","length":937},"id":"CVE-2026-45320-8a28631c"},{"id":"CVE-2026-45320-8b3b187d","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/manage/ChartDataManage.java"},"deprecated":false,"digest":{"line_hashes":["209292963457385366406221834526539915324","234918761754045158253303231372730315928","264198666136338931898651125278186872478","316687935712199309605363540785562783282","100832192362131475097875819285021579564","259676085684166065324554717156507207913","51310160502206110128676033415172250537","167962866171322965283043645943212309327"],"threshold":0.9}},{"target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/bar/BulletGraphHandler.java"},"deprecated":false,"digest":{"line_hashes":["54595416773809418504935865440309366088","253312199771048934330860119073316466088","238961318420169142703367577908393642813","38552155725750463462066382105281136199","49878568855741375923852847669510250193"],"threshold":0.9},"id":"CVE-2026-45320-a3a68f1d","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13"},{"deprecated":false,"digest":{"line_hashes":["261236070576652220946764524042390711888","8416144773828899743018209536712767808","56400381638992486365054270138904392516","132950895353837373950095529978835133862","314768328130780554667996853824180700649"],"threshold":0.9},"id":"CVE-2026-45320-a524cbad","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/bar/BarHandler.java"}},{"source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/bar/BarHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"193185995640640143658023997544100308895","length":1712},"id":"CVE-2026-45320-c420559b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"113134034944002945906580769488022182941","length":7532},"id":"CVE-2026-45320-c8cebab4","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TablePivotHandler.java","function":"calcCustomExpr"}},{"digest":{"function_hash":"127154678109201301536001619213815581502","length":5868},"id":"CVE-2026-45320-cb8d0de3","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/dataset/manage/DatasetSQLManage.java","function":"getUnionSQLForEdit"},"deprecated":false},{"id":"CVE-2026-45320-cbf9caa8","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/manage/ChartDataManage.java","function":"sqlData"},"deprecated":false,"digest":{"function_hash":"189185817082238549291202348831957446794","length":6596}},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/numeric/NumericalChartHandler.java"},"deprecated":false,"digest":{"line_hashes":["14976243502146607647771885108180968339","38804551854486466634454750266173226908","118965973651184003995497546791363184228","126766184909484436520192617199288803406","307312445851575777738740055050875686220"],"threshold":0.9},"id":"CVE-2026-45320-d414e11e","signature_type":"Line"},{"target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/YoyChartHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"242553084109477260530137936880391257219","length":2108},"id":"CVE-2026-45320-d5fdee5a","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13"},{"deprecated":false,"digest":{"length":1712,"function_hash":"193185995640640143658023997544100308895"},"id":"CVE-2026-45320-d7333d2c","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/line/StackAreaHandler.java","function":"calcChartResult"}},{"digest":{"line_hashes":["263794241334090260674021194648278512533","8416144773828899743018209536712767808","95510181812480759660631453753056088097","290504499243474563690826137053333953566","104669100409957336490575318213248830826","50880485056913437294195101831765284399","8416144773828899743018209536712767808","335875458289066119260762534170958335795","56594815899668572066156596536897853786","167410390355648620860439972425722432145"],"threshold":0.9},"id":"CVE-2026-45320-da9a2c38","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/mix/MixHandler.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["14976243502146607647771885108180968339","38804551854486466634454750266173226908","118965973651184003995497546791363184228","215688305515202206340512905885917982942","134011414553433175621997743928881368075","86529209828000303272607338572186670619","281978522779574450253390341337837000799","91868472183416680591057414140467366355","3077812344107724913323331239515083004","13927696648097125552690218815856950739","123735528055073965134737179070235990960"],"threshold":0.9},"id":"CVE-2026-45320-e8492cba","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/map/SymbolicMapHandler.java"}},{"id":"CVE-2026-45320-f4636bd0","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TableHeatmapHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"276229289474731251228846770885191152458","length":1646}},{"target":{"file":"core/core-backend/src/main/java/io/dataease/commons/utils/DeSqlparserUtils.java"},"deprecated":false,"digest":{"line_hashes":["169279030762016509075069182702824267625","160734463550684663804084704187036593870","278548163906911122525105326814795969818","186580344544812758372195220092115162022","333869444881811679379045706127104193635","79650778705642383157909830540012938201","136951935738281228591071960132187809933","237013911822916336951696405693612713837","124753680448353280224698034039214854661","30129115447867315023175243542459130740","283814892887194120046092011590890409833","134800491143236250928064628428893860811","2262009612907001638668498211534033920","238422346425478855275610625595152389753","37850783237920448701467014707894823944","274483806861524404820028033384896080005","75535756498659147844027315293466197129","32081922171630482065467924621543848309","278226501820087235308529212336346324083","313651458976405965450895970673960053142","109995117166073429784979080084805154013","4753835557364860143860346185263639603","71297903016147089027884133188419608905","41724426196527670118030564013097870646","277491472499219528407768888240067829805","29611098603950582783042361744009384566","30342821997596552544799585249364957135","3076326098900219644156439568347315189","135983581665040701282502503822989677777","269669861593541919104571991100903262267","178553971416540695499226250555219296306","62633711428356289019068935162046391520","268433838785850067481594223090417091913","203301394663457516374849135715433641812","288970138335416434037926437280312928850","72642336572214532763915532981122998119","63300358893352895371255501091631083427","131931913865056587094979111386489809988","242582212459999322959658379853534823978","323135813544317101494567898674671763010","39014590715081144955478769171408591418","301742347698082452787718643410147205545","253454983143418950287202608842510658747","307226502971463747401238871969988123074","179279602183136537969094586255425335850","68461072960420554947611487731949650452","113002029466648000056946307603696446694","76094129670055022011491132171479840822","38942421848055948632418036494353928223","141342390908483108128801768787806530440","29070751068537465925891408565335732361","152088955421755005443404591828278343257","157964181622117291409534123851970041328","285677115616476710642775503134385992129","26841041073240034196690330590853284493","190299082501829518672232623454344953824","10511607606444800013765825374126336913","232369305176281562331002317764770601285","131833439703611952133447894176306392424","288973317199507919988446075113440477601","284900577566451915345095470348696978562","255709179803808558644334474553729259518","118314911624895214981392364840215204606","80633390313417949317553206906852864633","247529548400618758954304782844184502944","213061802163639140784944605304607169157","302630276220737443622867271067426826215","35966509017756063286623379198562193364","37539333496501197823350162278667453864","67244637138019669846759241369276537800","79799918327550831139217160669498358605","191262707915280288200238121101863206237","167520643009321846810757786696483143990","217859012421623317712915006029926486566","227600580913045269840252877774349213647","62611069391108027987109847619538868421","84679252387639338729598717618411157666","47670101221982536878189123357313474461","56262954648546405433974717473893451975","280149136403024092882976054493055710132","136667801363474451697171120113511110372","114216053417171920856345641382372312152","323763977828970817625658005641848835850","233018204385839075765538413613135677263","279226626073256805613729974880683103678","223235519646683032593694410353412231439","218087211365491836042535783666485289793","22138089143179663118874533409485816176","58709740926574183794898264427983753185","142331792310711333783213960756411642071","30373951224593748408853535471019932462","228674077855244686721525454282226013596","56182063040452106116662867335728546866","336895996550068852232931455061167618481","223778580507869872022923482901384618659","8656345438210537153822114352288718778","37806550738642808638811580504913486185","275833832887782809887874483761204368250","137093810132186261313162027310026417287","322748410985940767416611765941064118919","285241813174993094949937567352645798015","277934281842988826878601678399076203881","246359006005582844220797817391690322254","103270659362699006580646873564047033094","49323648113419846656560195145890533111","277315428251280107674206758916436887969","43693651672511506419582617180681485734"],"threshold":0.9},"id":"CVE-2026-45320-f46e5771","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/163d510c6935a4010727392f5a680a7dc15abb13","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/charts/impl/table/TableNormalHandler.java","function":"calcChartResult"},"deprecated":false,"digest":{"function_hash":"227744248783201829069439160534129997274","length":9217},"id":"CVE-2026-45320-f9d2deb6"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45320.json","vanir_signatures_modified":"2026-08-12T16:24:35Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}