{"id":"CVE-2026-90529","summary":"DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting","details":"A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic Map. Such manipulation of the argument canvasViewInfo[*].customAttr.tooltip.backgroundColor leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.","modified":"2026-09-17T03:30:20.861735570Z","published":"2026-09-13T14:45:11.615Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-79","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90529.json"},"references":[{"type":"WEB","url":"https://github.com/dataease/dataease/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90529.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90529"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90529"},{"type":"ADVISORY","url":"https://vuldb.com/submit/912538"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403119"},{"type":"REPORT","url":"https://github.com/dataease/dataease/issues/18846"},{"type":"REPORT","url":"https://vuldb.com/vuln/403119/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dataease/dataease","events":[{"introduced":"86591e09567ffe552519d7e65d312164672b5626"},{"last_affected":"04129b006b2a51447fb15f5c32138f39a4fd4fec"}],"database_specific":{"extracted_events":[{"introduced":"2.10.0"},{"last_affected":"2.10.0"},{"introduced":"2.10.1"},{"last_affected":"2.10.1"},{"introduced":"2.10.2"},{"last_affected":"2.10.2"},{"introduced":"2.10.3"},{"last_affected":"2.10.3"},{"introduced":"2.10.4"},{"last_affected":"2.10.4"},{"introduced":"2.10.5"},{"last_affected":"2.10.5"},{"introduced":"2.10.6"},{"last_affected":"2.10.6"},{"introduced":"2.10.7"},{"last_affected":"2.10.7"},{"introduced":"2.10.8"},{"last_affected":"2.10.8"},{"introduced":"2.10.9"},{"last_affected":"2.10.9"},{"introduced":"2.10.10"},{"last_affected":"2.10.10"},{"introduced":"2.10.11"},{"last_affected":"2.10.11"},{"introduced":"2.10.12"},{"last_affected":"2.10.12"},{"introduced":"2.10.13"},{"last_affected":"2.10.13"},{"introduced":"2.10.14"},{"last_affected":"2.10.14"},{"introduced":"2.10.15"},{"last_affected":"2.10.15"},{"introduced":"2.10.16"},{"last_affected":"2.10.16"},{"introduced":"2.10.17"},{"last_affected":"2.10.17"},{"introduced":"2.10.18"},{"last_affected":"2.10.18"},{"introduced":"2.10.19"},{"last_affected":"2.10.19"},{"introduced":"2.10.20"},{"last_affected":"2.10.20"},{"introduced":"2.10.21"},{"last_affected":"2.10.21"},{"introduced":"2.10.22"},{"last_affected":"2.10.22"},{"introduced":"2.10.23"},{"last_affected":"2.10.23"},{"introduced":"2.10.24"},{"last_affected":"2.10.24"},{"introduced":"2.10.25"},{"last_affected":"2.10.25"},{"introduced":"2.10.26"},{"last_affected":"2.10.26"}],"source":"AFFECTED_FIELD"}}],"versions":["2.10.0","2.10.1","2.10.10","2.10.11","2.10.12","2.10.13","2.10.14","2.10.15","2.10.16","2.10.17","2.10.18","2.10.19","2.10.2","2.10.20","2.10.21","2.10.22","2.10.23","2.10.24","2.10.25","2.10.26","2.10.3","2.10.4","2.10.5","2.10.6","2.10.7","2.10.8","2.10.9","v2.10.26","v2.10.25","v2.10.24","v2.10.23","v2.10.22","v2.10.21","v2.10.20","v2.10.19","v2.10.18","v2.10.17","v2.10.16","v2.10.15","v2.10.14","v2.10.13","v2.10.12","v2.10.11","v2.10.10","v2.10.9","v2.10.8","v2.10.7","v2.10.6","v2.10.5","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90529.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"}]}