PT-2026-33353 · Dataease · Dataease

Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-33084

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.21

Description An authenticated attacker can perform time-based blind SQL injection. The issue occurs because the DatasetDataManage service layer transfers user-supplied values to the sorting metadata DTO, which is then passed to Order2SQLObj and incorporated into the SQL ORDER BY clause without whitelist validation before execution via CalciteProvider. The affected API endpoint is '/de2api/datasetData/enumValueObj' and the vulnerable parameter is sort.

Recommendations Update to version 2.10.21. Avoid using the parameter sort in the '/de2api/datasetData/enumValueObj' endpoint as a temporary mitigation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33084

Affected Products

Dataease

References · 5

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-r897-r9q8-3p2x · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33084 · Security Note
• https://github.com/dataease/dataease/releases/tag/v2.10.21 · Note
• https://twitter.com/VulmonFeeds/status/2044968726076735895 · Twitter Post
• https://twitter.com/CVEnew/status/2045102660496376134 · Twitter Post