CVE-2025-53006 Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability

High 8.9 Published 2 Jul 2025 Updated 2 Jul 2025

Attackers can inject malicious JDBC parameters in DataEase to execute arbitrary code via unsafe PostgreSQL or Redshift connection settings.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-53006?

CVE-2025-53006 is a high-severity code injection vulnerability in Dataease Dataease, published on 2 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.

Weakness: CWE-153

Which versions are affected by CVE-2025-53006?

It affects 1 product.

Products include Dataease Dataease.

How do I fix CVE-2025-53006?

No fix has been published for CVE-2025-53006 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-53006 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53006 exists.

All Dataease Dataease vulnerabilities

Sources

Also known as GHSA-q726-5pr9-x7gm.