CVE-2026-32137: DataEase SQL Injection Vulnerability

Q: What is the severity of CVE-2026-32137?

CVE-2026-32137 has a high severity due to the potential for SQL injection attacks.

Q: How do I fix CVE-2026-32137?

To fix CVE-2026-32137, you should upgrade DataEase to version 2.10.20 or later.

Q: What components are affected by CVE-2026-32137?

CVE-2026-32137 affects the /de2api/datasource/previewData component in versions prior to 2.10.20.

Q: What type of vulnerability is CVE-2026-32137?

CVE-2026-32137 is classified as an SQL Injection vulnerability.

Q: Can CVE-2026-32137 be exploited remotely?

Yes, CVE-2026-32137 can potentially be exploited remotely due to its exposure in an API.

Published Mar 12, 2026

Updated

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.

Affected Software

2 affected components

Dataease DataEase<2.10.20

Event History

Mar 12, 2026

CVE Published

via MITRE·05:53 PM

Data Sourced

via MITRE·05:53 PM

DescriptionWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Nov 13, 58169

Event

via FIRST·04:55 PM

Frequently Asked Questions

What is the severity of CVE-2026-32137?

CVE-2026-32137 has a high severity due to the potential for SQL injection attacks.

How do I fix CVE-2026-32137?

To fix CVE-2026-32137, you should upgrade DataEase to version 2.10.20 or later.

What components are affected by CVE-2026-32137?

CVE-2026-32137 affects the /de2api/datasource/previewData component in versions prior to 2.10.20.

What type of vulnerability is CVE-2026-32137?

CVE-2026-32137 is classified as an SQL Injection vulnerability.

Can CVE-2026-32137 be exploited remotely?