CVE-2026-33122: DataEase has SQL Injection via Datasource Management
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource update process. When a new table definition is added during a datasource update via /de2api/datasource/update, the deTableName field from the user-submitted configuration is passed to DatasourceSyncManage.createEngineTable, where it is substituted into a CREATE TABLE statement template without any sanitization or identifier escaping. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information. This issue has been fixed in version 2.10.21.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33122?
CVE-2026-33122 has been classified with a high severity due to its SQL injection vulnerability affecting multiple versions.
How do I fix CVE-2026-33122?
To fix CVE-2026-33122, upgrade DataEase to version 2.10.21 or later.
Which versions are affected by CVE-2026-33122?
CVE-2026-33122 affects DataEase versions 2.10.20 and below.
What type of vulnerability is CVE-2026-33122?
CVE-2026-33122 is a SQL injection vulnerability found in the API datasource update process.
Can I exploit CVE-2026-33122 remotely?
Yes, CVE-2026-33122 can potentially be exploited remotely if an attacker has access to the API.