CVE-2026-75979: Improper Neutralization of Special Elements Used in a Template Engine in xianrendzw EasyReport
A vulnerability exists in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the SQL Preview Endpoint component. The flaw involves improper neutralization of special elements in the execSqlText/previewSqlText function, allowing remote attackers to manipulate the sqlText argument. The vulnerability is identified as CWE-791 and has a CVSS 3.1 score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. The issue was reported early to the project, but no response or patch has been provided yet. Exploit code has been publicly disclosed but no active exploitation is known. No affected versions are explicitly stated beyond the upper bound version mentioned.
AI Analysis
Technical Summary
CVE-2026-75979 is a vulnerability in xianrendzw EasyReport up to version 2.0.17.0522_Beta affecting the execSqlText/previewSqlText function in DesignerController.java within the SQL Preview Endpoint. The vulnerability arises from improper neutralization of special elements used in a template engine when processing the sqlText argument, enabling remote attackers to potentially execute unauthorized actions. The vulnerability is classified under CWE-791 (Improper Neutralization of Special Elements used in a Template Engine). The project was notified early but has not issued a fix or response. Public exploit code is available, but no known active exploitation has been reported.
Potential Impact
The vulnerability allows remote attackers to manipulate SQL preview functionality by injecting specially crafted sqlText, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score of 6.3 reflects a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and unchanged scope.
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a patch is released, consider restricting access to the SQL Preview Endpoint to trusted users only and applying network-level controls to limit exposure. Review and harden template engine usage and input validation if possible.
CVE-2026-75979: Improper Neutralization of Special Elements Used in a Template Engine in xianrendzw EasyReport
Description
A vulnerability exists in xianrendzw EasyReport up to version 2.0.17.0522_Beta in the SQL Preview Endpoint component. The flaw involves improper neutralization of special elements in the execSqlText/previewSqlText function, allowing remote attackers to manipulate the sqlText argument. The vulnerability is identified as CWE-791 and has a CVSS 3.1 score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. The issue was reported early to the project, but no response or patch has been provided yet. Exploit code has been publicly disclosed but no active exploitation is known. No affected versions are explicitly stated beyond the upper bound version mentioned.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75979 is a vulnerability in xianrendzw EasyReport up to version 2.0.17.0522_Beta affecting the execSqlText/previewSqlText function in DesignerController.java within the SQL Preview Endpoint. The vulnerability arises from improper neutralization of special elements used in a template engine when processing the sqlText argument, enabling remote attackers to potentially execute unauthorized actions. The vulnerability is classified under CWE-791 (Improper Neutralization of Special Elements used in a Template Engine). The project was notified early but has not issued a fix or response. Public exploit code is available, but no known active exploitation has been reported.
Potential Impact
The vulnerability allows remote attackers to manipulate SQL preview functionality by injecting specially crafted sqlText, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score of 6.3 reflects a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and unchanged scope.
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a patch is released, consider restricting access to the SQL Preview Endpoint to trusted users only and applying network-level controls to limit exposure. Review and harden template engine usage and input validation if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gwjc-mxgh-5h28
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-75979"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a85b4c5acd9273b49252555
Added to database: 08/19/2026, 13:51:01 UTC
Last enriched: 08/19/2026, 14:35:22 UTC
Last updated: 08/19/2026, 17:32:20 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.