Which versions of DataEase are affected by EUVD-2026-23284?

DataEase versions 2.10.20 and below allow authenticated users to inject SQL commands via the datasetData endpoint, enabling unauthorized access to and modification of database records.. A patch is available.

How to fix or mitigate EUVD-2026-23284?

Within 24 hours, inventory all DataEase deployments and identify systems running version 2.10.20 or earlier, prioritizing those accessible from untrusted networks or used for sensitive data analysis. Within 7 days, apply the available vendor patch to all affected instances. Within 30 days, review authentication and access logs for the datasetData enum-value endpoint, audit user role assignments to enforce least-privilege database access, and verify patch deployment across the entire DataEase infrastructure.

DataEase EUVD-2026-23284

Q: What is the CVSS score of EUVD-2026-23284?

EUVD-2026-23284 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33084 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Remotely reachable low-complexity SQLi needing only a low-privilege authenticated account (PR:L) and no interaction; injection into executed SQL yields high confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:28 vuln.today

Analysis Generated

Jul 24, 2026 - 07:28 vuln.today

Patch released

Apr 20, 2026 - 16:36 nvd

Patch available

Apr 16, 2026 - 19:16 EUVD

EUVD ID Assigned

Apr 16, 2026 - 18:45 euvd

EUVD-2026-23284

CVE Published

Apr 16, 2026 - 18:14 nvd

HIGH 8.7

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the sorting metadata DTO, which is passed to Order2SQLObj where it is incorporated into the SQL ORDER BY clause without any whitelist validation, and then executed via CalciteProvider. An authenticated attacker can inject arbitrary SQL commands through the sort parameter, enabling time-based blind SQL injection. This issue has been fixed in version 2.10.21.

AnalysisAI

SQL injection in DataEase, an open-source data visualization and analytics platform, lets an authenticated user inject arbitrary SQL via the sort parameter of the datasetData enum-value endpoint, achieving time-based blind SQL injection against the backing database. All versions 2.10.20 and below are affected, with a total-impact potential to read, alter, or disrupt data. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not listed in CISA KEV, but the technical impact is rated total.

Technical ContextAI

The flaw is a classic CWE-89 SQL injection rooted in unsafe construction of a SQL ORDER BY clause. In DataEase's DatasetDataManage service layer, the user-supplied sort value is copied directly into the sorting metadata DTO and handed to Order2SQLObj, which concatenates it into the ORDER BY clause with no whitelist or allow-list validation of column names or sort direction. The resulting SQL is executed through DataEase's CalciteProvider (Apache Calcite-based query engine), so the injected expression runs against the underlying data source. ORDER BY injection is a well-known blind-SQLi sink because the clause sits outside typical parameterization and often permits subqueries and time-delay functions. The affected component per CPE is cpe:2.3:a:dataease:dataease, and the v2.10.21 release notes confirm this is one of several ORDER-BY/Calcite SQLi issues fixed in the same batch (alongside CVE-2026-33083 and CVE-2026-33207).

RemediationAI

Vendor-released patch: version 2.10.21 - upgrade DataEase to 2.10.21 or later, which adds validation to the ORDER BY / sort handling in the DatasetDataManage flow (see release https://github.com/dataease/dataease/releases/tag/v2.10.21 and advisory https://github.com/dataease/dataease/security/advisories/GHSA-r897-r9q8-3p2x). Note that 2.10.21 introduces a breaking change: frontend user credential names gain a prefix (e.g. user.token becomes de_v2_user.token), which affects integrations such as SQLBot advanced apps, so plan for that adjustment during the upgrade. If immediate patching is not possible, apply compensating controls: restrict network access to the DataEase application and its /de2api dataset endpoints to trusted users only (reverse-proxy allow-listing or VPN), since exploitation requires an authenticated account, tighten account provisioning and revoke unneeded low-privilege logins, and deploy a WAF rule to reject non-whitelisted characters/keywords in the sort parameter (trade-off: WAF signatures for blind ORDER BY injection are easy to bypass and may break legitimate multi-column sorts, so treat it as stop-gap only). Use a least-privilege database account for DataEase data sources to limit the blast radius of any injected query.