CVE-2023-7299 is an injection flaw in DataGear, a data visualization tool, up to version 4.60. It sits in the /dataSet/resolveSql endpoint and scores 6.3 (Medium). The maintainer fixed it in version 4.7.0 in January 2024, so upgrade to 4.7.0 or later and limit who has accounts.
What's affected
Affected: DataGear up to and including 4.60. Fixed: 4.7.0, per the record and the project's GitHub issue, where the maintainer replied on 3 January 2024 that the new 4.7.0 release fixes it.
Source conflict: NVD describes the issue as SQL injection through the sql argument and lists CWE-74 and CWE-89. The GitHub issue is titled as a template injection vulnerability in the same endpoint and says it can lead to remote code execution. These may describe the same flaw from different angles. Either way, the fixed version is the same, and the practical risk may be higher than a medium score suggests.
The vector is network reachable with low privileges, so an account is needed. KEV is false and no source I read describes exploitation in the wild.
How to check if you're exposed
DataGear is a self-hosted web application. Open the About page or the footer to read the version, or check the file name of the release you installed. Anything at 4.60 or below is affected.
Also check who has accounts. The endpoint requires a login, but data tools often have many users who can create datasets, and each of them could reach the flaw.
What to do now
- Upgrade DataGear to 4.7.0 or later from the project's official site.
- Review the accounts that can create or edit datasets, and remove those that do not need it.
- Run DataGear as a low privilege service account, in a container or a restricted host, so that a code execution bug has limited reach.
- Give DataGear connections to databases only the read rights they need.
- Check logs for dataset resolution requests from unexpected users.
Why it matters
Injection bugs happen when user supplied text is interpreted as part of a language: SQL, a template language or a shell command. Dataset tools are exposed to this by design, because they let users write queries and transformations. The risk is in what the server evaluates, and with what rights.
The maintainer's fix landed in a point release, which makes this an easy upgrade. The harder part is knowing where DataGear runs. Internal analytics tools get installed by a team and forgotten, and they often hold credentials to production databases.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is it SQL injection or template injection?
NVD calls it SQL injection. The project's issue describes template injection. Both point to the same endpoint and the same fixed version.
What is the fix?
Upgrade to DataGear 4.7.0 or later.
Sources
Last reviewed: 19 October 2026.
