Critical severity9.8NVD Advisory· Published Nov 20, 2025· Updated Jun 17, 2026

CVE-2025-64428

Description

Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dataease/Dataeasev53 versions
< 2.10.17+ 2 more
- (no CPE)range: < 2.10.17
- (no CPE)range: <2.10.17
- cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*range: <2.10.17

Patches

Vulnerability mechanics

References

github.com/dataease/dataease/commit/b7e585c1cc3fc2b73cb289b8680b4b3914be3d53nvdPatch
github.com/dataease/dataease/security/advisories/GHSA-88ph-3236-2m2hnvdExploitVendor Advisory
github.com/dataease/dataease/releases/tag/v2.10.17nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000