This vulnerability in DataEase up to versions 2.10.26 involves improper handling of input in the buildTooltip function within the Symbolic Map component's source file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts. Specifically, the argument canvasViewInfo[*].customAttr.tooltip.backgroundColor can be manipulated to inject malicious scripts, resulting in cross-site scripting. The attack vector is remote, with low attack complexity and requires user interaction. The project was notified early but has not issued a fix or advisory.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires low privileges and user interaction but does not involve elevated privileges or system-level compromise. No known exploits in the wild have been reported.

No official patch or vendor advisory is currently available. Users should monitor the vendor's communications for updates. In the meantime, consider applying input validation or sanitization on the affected parameter as a temporary mitigation. Avoid exposing the vulnerable component to untrusted users until a fix is released.