CVE-2025-49002

What it actually does

The patch for CVE-2025-32966 blocks INIT and RUNSCRIPT but the check is case-sensitive, allowing bypass via mixed or lower-case variants that still execute the underlying H2 database commands.

Why it matters to the business

Attackers can run arbitrary database scripts on business-intelligence instances, leading to data theft, tampering, or full system takeover with no available workarounds until patched.

How an attack unfolds

An attacker with network access to a DataEase instance sends crafted requests containing case-varied versions of the blocked keywords; the filter is evaded, the H2 engine executes the script, and the attacker obtains code execution or data access. Weaponized exploits exist and the EPSS score has risen 7 % in the last 30 days.

How to fix it

Upgrade dataease/dataease to commit 3b8f018abb6d3846a7ebb694bbe5cbf35a932104 (version 2.10.10) or later. Update Chainguard ruby3.3-fluentd-kubernetes-daemonset images to 1.16.6.1.2-r2. No workarounds exist; apply the update immediately given weaponized exploit maturity.

How to confirm the fix worked

Verify the running version string reports 2.10.10 or newer; confirm the commit hash 3b8f018abb6d3846a7ebb694bbe5cbf35a932104 is present in the source tree; test that both upper- and lower-case INIT/RUNSCRIPT inputs are now rejected.

Typical attack path

1. Locate an internet-facing DataEase deployment running a version before 2.10.10
2. Submit HTTP requests or form data containing INIT, init, RunScript or similar case variants
3. Trigger execution of attacker-controlled SQL or scripts inside the embedded H2 database
4. Escalate to data exfiltration or remote code execution

How to detect it

Search web-server and application logs for any occurrence of INIT, RUNSCRIPT, init, runscript or mixed-case equivalents in request bodies or query parameters; correlate with H2 database error or execution events.

• INIT
• init
• RUNSCRIPT
• runscript
• RunScript

What your security team should do

• Upgrade all DataEase instances to the fixed commit or version 2.10.10 within the next 48 hours
• Add case-insensitive keyword blocking for INIT and RUNSCRIPT in any custom input-validation layers
• Hunt for prior exploitation using request logs containing mixed-case variants of the blocked commands