Which versions of DataEase are affected by CVE-2026-33121?

DataEase versions through 2.10.20 contain a SQL injection vulnerability in the API datasource workflow that allows authenticated users to extract sensitive database information including backend…. A patch is available.

How to fix or mitigate CVE-2026-33121?

Within 24 hours: Identify and inventory all DataEase deployments, document current versions, and assess which instances expose API access to external users. Within 7 days: Upgrade all DataEase instances to version 2.10.21 across production and non-production environments; restrict datasource API endpoints to necessary users only during the upgrade window. Within 30 days: Review API access logs from versions 2.10.20 and earlier for suspicious SQL patterns or repeated error-based queries; perform forensic analysis to determine if any database credentials were exposed; verify database security posture including credential rotation if any compromise is suspected.

DataEase CVE-2026-33121

Q: What is the CVSS score of CVE-2026-33121?

CVE-2026-33121 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23286 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable authenticated endpoint (PR:L, AV:N, AC:L); SQL injection into a DDL context enables data disclosure (C:H) and modification (I:H), with limited/possible availability impact (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:27 vuln.today

Analysis Generated

Jul 24, 2026 - 07:27 vuln.today

Patch released

Apr 20, 2026 - 16:37 nvd

Patch available

Apr 16, 2026 - 19:16 EUVD

EUVD ID Assigned

Apr 16, 2026 - 18:45 euvd

EUVD-2026-23286

CVE Published

Apr 16, 2026 - 18:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.

AnalysisAI

SQL injection in DataEase, the open-source data visualization and analytics platform, allows an authenticated user to execute arbitrary SQL through the API datasource save workflow in all versions up to and including 2.10.20. The flaw stems from the Base64-encoded 'deTableName' value being spliced into a DDL statement via unsanitized string replacement, letting an attacker break out of identifier quoting to run error-based injection that leaks backend database details such as the MySQL version. SSVC rates the technical impact as total and automatable, though publicly available exploit code exists only as a proof of concept and EPSS remains very low (0.03%); the issue is fixed in 2.10.21.

Technical ContextAI

DataEase is a Java/Spring-based BI platform that lets users register external and API datasources, whose configuration is transported as a Base64-encoded blob. During the save process the application derives a physical/logical table name from the 'deTableName' field and injects it into a Data Definition Language (DDL) statement using plain string concatenation/replacement rather than parameterized queries or identifier escaping. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause: because identifier quoting is applied by simple substitution, a crafted table name containing quote/backtick characters can terminate the identifier context and append attacker-controlled SQL. The CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* confirms the DataEase application itself is the affected product across all versions prior to the fix. This CVE is one of a cluster of SQL injection issues (CVE-2026-33082/33083/33084/33122/33207) remediated together in v2.10.21, indicating systemic unsafe SQL string handling across multiple DataEase code paths.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.21 or later, which fixes the datasource-save SQL injection (per advisory GHSA-fg4m-q7ch-jqv5). Note that 2.10.21 introduces a breaking change - frontend user credential names gain a de_v2_ prefix (e.g. user.token becomes de_v2_user.token), which affects integrations such as SQLBot advanced apps, so test credential references after upgrading. If immediate upgrade is not possible, apply compensating controls: restrict access to the datasource management/API-save endpoints to trusted administrators only (this feature requires an authenticated account, so tightening account provisioning and removing low-privilege users' datasource-creation rights meaningfully reduces exposure, at the cost of limiting self-service datasource setup); place the DataEase console behind a VPN or IP allowlist and a WAF tuned to inspect Base64-decoded request bodies for SQL metacharacters in the deTableName field (WAF coverage is imperfect against encoded/obfuscated payloads); and ensure the database account used by DataEase runs with least privilege to limit the blast radius of any injected DDL. Advisory: https://github.com/dataease/dataease/security/advisories/GHSA-fg4m-q7ch-jqv5 ; release: https://github.com/dataease/dataease/releases/tag/v2.10.21.