CVE-2026-33083: DataEase has SQL Injection in Order By Clause
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the orderDirection parameter used in dataset-related endpoints including /de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset. The Order2SQLObj class directly assigns the raw user-supplied orderDirection value into the SQL query without any validation or whitelist enforcement, and the value is rendered into the ORDER BY clause via StringTemplate before being executed against the database. An authenticated attacker can inject arbitrary SQL commands through the sorting direction field, enabling time-based blind data extraction and denial of service. This issue has been fixed in version 2.10.21.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33083?
CVE-2026-33083 has a high severity rating due to its potential to allow unauthorized data access through SQL injection.
How do I fix CVE-2026-33083?
To fix CVE-2026-33083, upgrade to version 2.10.21 or later of DataEase where the vulnerability has been patched.
What type of vulnerability is CVE-2026-33083?
CVE-2026-33083 is an SQL injection vulnerability specifically affecting the orderDirection parameter.
Which software versions are affected by CVE-2026-33083?
Versions of DataEase up to and including 2.10.20 are affected by CVE-2026-33083.
Where can I find more information about CVE-2026-33083?
More information about CVE-2026-33083 can be found in the security advisories on GitHub related to DataEase.