CVE-2026-72743 is a stored cross-site scripting vulnerability in dataease SQLBot through version 1.10.0. The issue exists in the SQText dashboard component, which renders TinyMCE output via v-html without sanitization, enabling attackers with the ability to modify dashboard text widget content to inject arbitrary HTML and JavaScript. This malicious code executes for all users viewing the dashboard, potentially leading to client-side script execution. The vulnerability was fixed in commit c3f40a5. No explicit vendor advisory or patch release information is provided, and the product is not a cloud service.

The vulnerability allows attackers with limited privileges (those able to modify dashboard text widget content) to inject and execute arbitrary HTML and JavaScript in the context of the dashboard viewed by other users. This can lead to client-side script execution affecting confidentiality and integrity of user sessions. The CVSS 4.0 score is 5.1 (medium severity), indicating a moderate risk without requiring user interaction or elevated privileges beyond the ability to modify dashboard content.

A fix for this vulnerability exists in commit c3f40a5. Users of SQLBot should update to a version that includes this commit or a later patched release once available. Since no official vendor advisory or patch release is referenced, users should monitor the vendor's official channels for an official patch or update. Until patched, restrict dashboard text widget modification permissions to trusted users only to reduce risk.