PT-2026-33359 · Dataease · Dataease

Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-33207

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.21

Description An authenticated attacker can execute arbitrary SQL commands, enabling error-based extraction of sensitive database information. The issue exists in the '/datasource/getTableField' endpoint, where the getTableFiledSql() function in CalciteProvider.java incorporates the tableName parameter directly into SQL query strings using String.format without parameterization or sanitization. While DatasourceServer.java validates that the table name exists, this check can be bypassed by registering an API datasource with a malicious deTableName, which is then returned by getTables and passes the validation.

Recommendations Update to version 2.10.21.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33207

Affected Products

Dataease

References · 4

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33207 · Security Note
• https://github.com/dataease/dataease/releases/tag/v2.10.21 · Note
• https://twitter.com/CVEnew/status/2045102653399576837 · Twitter Post