Which versions of DataEase are affected by CVE-2026-33207?

DataEase versions 2.10.20 and earlier contain a SQL injection vulnerability in the datasource API that allows authenticated users to execute arbitrary SQL commands against the underlying database.. A patch is available.

How to fix or mitigate CVE-2026-33207?

Within 24 hours, identify all DataEase instances in your environment and confirm their versions. Within 7 days, upgrade all instances running version 2.10.20 or earlier to DataEase 2.10.21 or later. Within 30 days, review database and application logs for indicators of SQL injection attempts, audit API datasource access permissions, and implement least-privilege controls for datasource creation.

DataEase CVE-2026-33207

Q: What is the CVSS score of CVE-2026-33207?

CVE-2026-33207 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23291 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

Java SQLi Dataease

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network endpoint with low complexity but requires an authenticated account able to register datasources (PR:L); arbitrary SQL yields high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:25 vuln.today

Analysis Generated

Jul 24, 2026 - 07:25 vuln.today

Patch released

Apr 20, 2026 - 16:41 nvd

Patch available

Apr 16, 2026 - 20:31 EUVD

CVSS changed

Apr 16, 2026 - 20:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 19:45 euvd

EUVD-2026-23291

CVE Published

Apr 16, 2026 - 19:37 nvd

HIGH 8.6

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the tableName parameter directly into SQL query strings using String.format without parameterization or sanitization. Although DatasourceServer.java validates that the table name exists in the datasource, an attacker can bypass this by first registering an API datasource with a malicious deTableName, which is then returned by getTables and passes the validation check. An authenticated attacker can execute arbitrary SQL commands, enabling error-based extraction of sensitive database information. This issue has been fixed in version 2.10.21.

AnalysisAI

SQL injection in DataEase, the open-source data visualization and analytics platform, lets an authenticated attacker execute arbitrary SQL commands via the /datasource/getTableField endpoint in versions 2.10.20 and earlier. The getTableFiledSql method in CalciteProvider.java concatenates the tableName parameter into a query using String.format without parameterization, and the existing table-name validation is bypassed by registering an API datasource with a malicious deTableName that getTables returns as legitimate. Publicly available exploit code exists per the SSVC assessment, though EPSS remains very low (0.03%, 8th percentile) and it is not in CISA KEV; it is one of a cluster of SQLi issues patched together in 2.10.21.

Technical ContextAI

DataEase is a Java-based BI/analytics platform (CPE cpe:2.3:a:dataease:dataease) that federates queries across heterogeneous data sources, using Apache Calcite as its SQL provider layer. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): CalciteProvider.java's getTableFiledSql method builds the metadata query with String.format(), injecting the caller-supplied tableName directly into the SQL text with no bind parameters or escaping. A defense in DatasourceServer.java checks that the supplied table exists among the datasource's tables, but this allowlist is populated dynamically from getTables - so an attacker who registers a custom API datasource controls the deTableName values returned, making a malicious name pass validation. This is a classic trust-boundary failure where server-side validation relies on attacker-influenced data.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.21, which parameterizes the CalciteProvider query and closes the validation-bypass path (release: https://github.com/dataease/dataease/releases/tag/v2.10.21; advisory: https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmm). Note that 2.10.21 introduces a breaking change - frontend user credential names gain a de_v2_ prefix (e.g. user.token becomes de_v2_user.token), which affects integrations such as SQLBot advanced apps, so plan credential-name updates as part of the upgrade. If immediate patching is not possible, restrict the ability to create/register datasources to trusted administrators only (the attack requires registering an API datasource with a malicious deTableName), limit and audit accounts that can reach the /datasource/getTableField endpoint, and place DataEase behind network access controls so only trusted users can authenticate; the trade-off is reduced self-service datasource functionality for users. Because 2.10.21 fixes multiple additional SQLi and other flaws (CVE-2026-33082/33083/33084/33121/33122 and others), upgrading is strongly preferred over piecemeal mitigation.