Which versions of DataEase are affected by EUVD-2026-23280?

DataEase instances running version 2.10.20 and earlier contain a SQL injection vulnerability in the dataset export endpoint that allows authenticated users to extract database contents.. A patch is available.

How to fix or mitigate EUVD-2026-23280?

Within 24 hours, identify all DataEase deployments currently running version 2.10.20 or below and document which users have permissions to access the affected dataset export endpoint; review audit logs for suspicious export activity patterns. Within 7 days, plan and execute an upgrade to DataEase version 2.10.21 or later across all affected instances in a controlled manner, prioritizing production environments. Within 30 days, complete the rollout to all remaining deployments, verify successful patching through version checks, and conduct a post-incident review of access logs to determine if the vulnerability was exploited.

DataEase EUVD-2026-23280

Q: What is the CVSS score of EUVD-2026-23280?

EUVD-2026-23280 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33082 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable low-complexity injection needing a low-privilege authenticated account (PR:L, UI:N); full SQL injection yields total database confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:30 vuln.today

Analysis Generated

Jul 24, 2026 - 07:30 vuln.today

Patch released

Apr 20, 2026 - 16:34 nvd

Patch available

Apr 16, 2026 - 19:16 EUVD

CVSS changed

Apr 16, 2026 - 18:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 18:00 euvd

EUVD-2026-23280

CVE Published

Apr 16, 2026 - 17:39 nvd

HIGH 8.7

DescriptionGitHub Advisory

DataEase is an open source data visualization analysis tool. Versions 2.10.20 and below contain a SQL injection vulnerability in the dataset export functionality. The expressionTree parameter in POST /de2api/datasetTree/exportDataset is deserialized into a filtering object and passed to WhereTree2Str.transFilterTrees for SQL translation, where user-controlled values in "like" filter terms are directly concatenated into SQL fragments without sanitization. An attacker can inject arbitrary SQL commands by escaping the string literal in the filter value, enabling blind SQL injection through techniques such as time-based extraction of database information. This issue has been fixed in version 2.10.21.

AnalysisAI

SQL injection in DataEase's dataset export endpoint (POST /de2api/datasetTree/exportDataset) lets an authenticated attacker inject arbitrary SQL through the expressionTree parameter in versions 2.10.20 and below. User-controlled values in 'like' filter terms are concatenated unsanitized into SQL during filter-tree translation, enabling blind, time-based extraction of database contents. Publicly available exploit code exists (SSVC: poc); EPSS is low (0.03%, 8th percentile) and the flaw is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.

Technical ContextAI

DataEase is an open-source business-intelligence and data-visualization platform. The vulnerable path is its dataset export feature: the expressionTree JSON parameter is deserialized into a filtering object and handed to WhereTree2Str.transFilterTrees, which converts the filter model into a SQL WHERE clause. For 'like' filter operators, the user-supplied value is directly string-concatenated into the generated SQL fragment rather than being bound as a parameter, so a value that closes the string literal (e.g. an embedded quote) breaks out of the intended predicate. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) failure rooted in dynamic query construction instead of parameterized queries. CPE cpe:2.3:a:dataease:dataease identifies the affected product.

RemediationAI

Upgrade to DataEase v2.10.21, which contains the vendor fix for this issue (Vendor-released patch: 2.10.21); note that this release also changes frontend credential naming (e.g. user.token becomes de_v2_user.token), which may require adjusting integrations such as SQLBot advanced apps, and it bundles fixes for several other SQL injection and related flaws (CVE-2026-33083, -33084, -33121, -33122, -33207 among others), so patching addresses multiple vulnerabilities at once. Refer to the advisory at https://github.com/dataease/dataease/security/advisories/GHSA-xxpw-2c8q-g693 and the release notes at https://github.com/dataease/dataease/releases/tag/v2.10.21. If immediate upgrade is not possible, compensating controls include restricting network access to the /de2api/datasetTree/exportDataset endpoint (and the DataEase management interface generally) to trusted networks via reverse-proxy or WAF rules that block quote/SQL metacharacters in the expressionTree payload - with the trade-off of possible false positives on legitimate filter values - tightening account provisioning so low-privilege accounts are not freely issued, and monitoring database logs for anomalous time-delay queries indicative of blind injection.