CVE-2026-33121: DataEase has SQL Injection via Datasource Save Flow
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33121?
CVE-2026-33121 is classified as a high severity vulnerability due to potential unauthorized data access through SQL injection.
How do I fix CVE-2026-33121?
To remediate CVE-2026-33121, upgrade DataEase to version 2.10.21 or later.
What versions of DataEase are affected by CVE-2026-33121?
DataEase versions 2.10.20 and below are affected by CVE-2026-33121.
What type of vulnerability is CVE-2026-33121?
CVE-2026-33121 is a SQL injection vulnerability found in the API datasource saving process of DataEase.
Can CVE-2026-33121 lead to data loss?
Yes, CVE-2026-33121 can potentially lead to data loss or compromise due to the ability to manipulate database queries.