CVE-2026-40900: DataEase has SQL Injection via Stacked Queries
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling allowMultiQueries=true, an attacker can break out of the subquery and execute arbitrary stacked SQL statements, including UPDATE and other write operations, against the connected database. An authenticated attacker with access to valid datasource credentials can achieve full read and write access to the underlying database. This issue has been fixed in version 2.10.21.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40900?
CVE-2026-40900 is classified as a high severity vulnerability due to the potential for unauthorized SQL query execution.
How do I fix CVE-2026-40900?
To fix CVE-2026-40900, upgrade DataEase to version 2.10.21 or later, which contains a patch for the SQL injection vulnerability.
What versions of DataEase are affected by CVE-2026-40900?
DataEase versions 2.10.20 and below are affected by CVE-2026-40900.
What impact does CVE-2026-40900 have on my DataEase installation?
CVE-2026-40900 allows attackers to execute arbitrary SQL commands, potentially leading to data leakage or manipulation.
Where can I find more information on CVE-2026-40900?
More information on CVE-2026-40900 can be found in the security advisories and release notes provided by the DataEase project.