Which versions of DataEase are affected by EUVD-2026-23282?

DataEase analytics platform (versions 2.10.20 and below) contains a SQL injection vulnerability in dataset endpoints that enables data extraction and denial of service through the orderDirection…. A patch is available.

How to fix or mitigate EUVD-2026-23282?

Within 24 hours, inventory all DataEase installations and identify systems running version 2.10.20 or earlier. Within 7 days, deploy DataEase version 2.10.21 across all affected systems, prioritizing production environments that store sensitive business data. Complete upgrades to all remaining systems within 30 days, then verify dataset query functionality and monitor access logs for suspicious activity on dataset endpoints.

DataEase EUVD-2026-23282

Q: What is the CVSS score of EUVD-2026-23282?

EUVD-2026-23282 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33083 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

Denial Of Service SQLi Dataease

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable authenticated injection (PR:L, AC:L) enabling blind data read (C:H) and query-based DoS (A:H); ORDER BY context makes reliable writes unlikely (I:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:30 vuln.today

Analysis Generated

Jul 24, 2026 - 07:30 vuln.today

Patch released

Apr 20, 2026 - 16:35 nvd

Patch available

Apr 16, 2026 - 19:16 EUVD

CVSS changed

Apr 16, 2026 - 18:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 18:00 euvd

EUVD-2026-23282

CVE Published

Apr 16, 2026 - 17:52 nvd

HIGH 8.7

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the orderDirection parameter used in dataset-related endpoints including /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset. The Order2SQLObj class directly assigns the raw user-supplied orderDirection value into the SQL query without any validation or whitelist enforcement, and the value is rendered into the ORDER BY clause via StringTemplate before being executed against the database. An authenticated attacker can inject arbitrary SQL commands through the sorting direction field, enabling time-based blind data extraction and denial of service. This issue has been fixed in version 2.10.21.

AnalysisAI

SQL injection in DataEase, an open-source data visualization and analytics platform, allows an authenticated user to inject arbitrary SQL through the orderDirection sorting parameter on dataset endpoints (/de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset) in versions 2.10.20 and below. Because the Order2SQLObj class places the raw value directly into the ORDER BY clause via StringTemplate with no whitelist, an attacker can perform time-based blind data extraction and denial of service. Publicly available exploit code exists (SSVC exploitation: poc); it is not in CISA KEV and the EPSS probability is very low (0.03%). Fixed in version 2.10.21.

Technical ContextAI

DataEase is a Java-based business-intelligence/data-visualization platform that builds SQL queries dynamically from user-driven dataset and charting parameters. The flaw is a classic CWE-89 (SQL Injection) failure of input neutralization: the Order2SQLObj class assigns the user-supplied orderDirection value (expected to be a bounded token such as ASC/DESC) directly into an ORDER BY clause rendered through a StringTemplate before execution. ORDER BY is a context where parameterized/prepared statements cannot bind values, so a strict allow-list of sort directions is the correct control; its absence lets attacker-controlled syntax reach the database engine. The affected component is identified by CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* covering all builds up to and including 2.10.20.

RemediationAI

Upgrade to DataEase v2.10.21, which the vendor release notes explicitly cite as fixing the ORDER BY SQL injection (CVE-2026-33083) along with several other SQLi and file-read issues; this is the primary and recommended fix (Vendor-released patch: 2.10.21, https://github.com/dataease/dataease/releases/tag/v2.10.21). Note an operational side effect of this release: frontend user credential names gain a prefix (for example user.token becomes de_v2_user.token), which requires updating integrations such as SQLBot advanced applications. If immediate patching is not possible, restrict network access to the DataEase application and tighten who holds authenticated accounts, since exploitation requires a valid low-privilege login; as an interim compensating control, block or filter access to the affected /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset endpoints at a reverse proxy or WAF and monitor for anomalous orderDirection values, accepting that this may break legitimate dataset export and enum-value features until the upgrade is applied. Refer to the advisory at https://github.com/dataease/dataease/security/advisories/GHSA-f443-95cf-m837 for details.