CVE-2026-33207 Details
Description
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the tableName parameter directly into SQL query strings using String.format without parameterization or sanitization. Although DatasourceServer.java validates that the table name exists in the datasource, an attacker can bypass this by first registering an API datasource with a malicious deTableName, which is then returned by getTables and passes the validation check. An authenticated attacker can execute arbitrary SQL commands, enabling error-based extraction of sensitive database information. This issue has been fixed in version 2.10.21.
A SQL injection vulnerability has been identified in DataEase versions prior to 2.10.21. The issue arises in the '/datasource/getTableField' endpoint, where the 'tableName' parameter is directly inserted into SQL query strings without proper sanitization or parameterization. This flaw allows authenticated attackers to execute arbitrary SQL commands, potentially leading to the extraction of sensitive database information. The vulnerability can be exploited by registering an API datasource with a malicious table name, which bypasses existing validation checks.
Users are advised to upgrade to DataEase version 2.10.21, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmm | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/dataease/dataease/releases/tag/v2.10.21 | [email protected] | Release Notes |
| https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmm | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dataease dataease | < 2.10.21 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |