Which versions of DataEase are affected by EUVD-2026-23290?

DataEase versions 2.10.20 and earlier contain a SQL injection vulnerability in the API datasource update endpoint that allows authenticated users to extract sensitive data from the underlying…. A patch is available.

How to fix or mitigate EUVD-2026-23290?

Within 24 hours, identify all DataEase instances in production and their current versions. Within 7 days, upgrade all affected systems to DataEase 2.10.21 or later; if immediate patching is not feasible, restrict datasource API endpoint access to trusted administrators only. Within 30 days, audit database access logs for evidence of unauthorized queries and confirm patch deployment across all instances.

DataEase EUVD-2026-23290

Q: What is the CVSS score of EUVD-2026-23290?

EUVD-2026-23290 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-33122 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

SQLi Dataease

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network endpoint reachable with valid low-privilege datasource credentials (PR:L, AV:N, AC:L); arbitrary SQL enables data extraction and modification (C:H/I:H) but no availability impact stated (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:25 vuln.today

Analysis Generated

Jul 24, 2026 - 07:25 vuln.today

Patch released

Apr 20, 2026 - 16:40 nvd

Patch available

Apr 16, 2026 - 20:31 EUVD

CVSS changed

Apr 16, 2026 - 20:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 19:45 euvd

EUVD-2026-23290

CVE Published

Apr 16, 2026 - 19:24 nvd

HIGH 8.6

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource update process. When a new table definition is added during a datasource update via /de2api/datasource/update, the deTableName field from the user-submitted configuration is passed to DatasourceSyncManage.createEngineTable, where it is substituted into a CREATE TABLE statement template without any sanitization or identifier escaping. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information. This issue has been fixed in version 2.10.21.

AnalysisAI

SQL injection in DataEase (versions ≤ 2.10.20) lets an authenticated user run arbitrary SQL against the backing database through the API datasource update endpoint. The attacker-controlled deTableName field is dropped into a CREATE TABLE statement without escaping, yielding error-based injection that can extract database contents. A proof-of-concept is indicated by CISA SSVC, though EPSS remains very low (0.03%) and it is not on CISA KEV; fixed in 2.10.21.

Technical ContextAI

DataEase is an open-source business-intelligence and data-visualization platform (analogous to Metabase/Superset) that connects to external databases and materializes definitions into its own engine tables. The flaw (CWE-89, Improper Neutralization of Special Elements in an SQL Command) sits in DatasourceSyncManage.createEngineTable: when a datasource update via /de2api/datasource/update adds a new table definition, the user-supplied deTableName is concatenated into a CREATE TABLE statement template as an identifier with no sanitization or identifier-quote escaping. Because deTableName is treated as a trusted identifier rather than parameterized or validated, a crafted value can break out of the quoting context and append attacker SQL. CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* confirms the affected product line.

RemediationAI

Vendor-released patch: 2.10.21 - upgrade to DataEase 2.10.21 or later, which fixes this along with several other SQL injection issues (CVE-2026-33082/33083/33084/33121/33207) disclosed in the same release. Note a breaking change: from 2.10.21 frontend user credential names gain a prefix (e.g. user.token becomes de_v2_user.token), which affects integrations such as SQLBot, so test dependent tooling before rollout. If immediate upgrade is not possible, restrict who can reach /de2api/datasource/update by limiting datasource-creation/update privileges to trusted administrators and placing the DataEase admin API behind network ACLs or a reverse proxy so only trusted operators can submit datasource configurations; the trade-off is reduced self-service datasource management for lower-trust users. Advisory: https://github.com/dataease/dataease/security/advisories/GHSA-28vg-3hv7-w92f ; release notes: https://github.com/dataease/dataease/releases/tag/v2.10.21.