DataEase has SQL Injection via Datasource Save Flow_CVE-2026-33121

8.7 / 10

HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.

AI Analysis

SQL injection vulnerability in the API datasource saving process via unsanitized table name

Basic Information

ID CVE-2026-33121

Source GitHub_M

Published Apr 16, 2026 at 18:16

Modified Apr 16, 2026 at 18:34

Affected Product

Vendor dataease

Product dataease

Version < 2.10.21

Affected Versions dataease dataease < 2.10.21

CWE Classification

CWE-89

AI Assessment

AI Score 8.7 / 10

AI Severity High

Vendor DataEase

Product DataEase

Version 2.10.20 and below

References

{
    "lastseen": "",
    "description": "DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.",
    "published": "2026-04-16T18:16:02.485Z",
    "modified": "2026-04-16T18:34:54.187Z",
    "type": "cve",
    "title": "DataEase has SQL Injection via Datasource Save Flow",
    "source": "GitHub_M",
    "references": "https://github.com/dataease/dataease/security/advisories/GHSA-fg4m-q7ch-jqv5\nhttps://github.com/dataease/dataease/releases/tag/v2.10.21",
    "id": "CVE-2026-33121",
    "bulletinFamily": "",
    "cwe": [
        "CWE-89"
    ],
    "cvelist": null,
    "sourceData": "dataease dataease < 2.10.21",
    "sourceHref": "",
    "cvss": {
        "score": 8.7,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "dataease",
    "version": "< 2.10.21",
    "vendor": "dataease",
    "ai_description": "SQL injection vulnerability in the API datasource saving process via unsanitized table name",
    "ai_severity": "High",
    "ai_vendor": "DataEase",
    "ai_product": "DataEase",
    "ai_version": "2.10.20 and below",
    "ai_score": 8.7
}