CVE-2026-33121

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.

Affected products

Dataease

Dataease

< 2.10.21

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

0.3% (25th percentile)

Weakness

CWE-89

NVD status

Analyzed

Published

2026-04-16

No exploit for CVE-2026-33121 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.