CVE-2025-58046

CVE-2025-58046 is a critical remote code execution vulnerability affecting Dataease versions up to 2.10.12, specifically within the Impala data source's getJdbc method. Attackers can exploit insufficient filtering to craft malicious JDBC connection strings, leading to JNDI injection and RMI deserialization. This allows for remote command execution with a CVSS score of 9.8 (Critical), indicating a network-exploitable vulnerability with no user interaction required, resulting in complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or publicly available exploit code, the vulnerability has garnered significant community discussion, suggesting awareness among researchers.