SQL Injection in Dataease
CVE-2026-33122
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource update process. When a new table definition is added during a datasource update vi…
Vulnerability class: SQL Injection
EPSS: 0.000 (2.5th percentile) — read the EPSS interpretation.
Affected products
- Dataease — versions < 2.10.21
Weakness classification (CWE)
References
- https://github.com/dataease/dataease/security/advisories/GHSA-28vg-3hv7-w92f (x_refsource_CONFIRM)
- https://github.com/dataease/dataease/releases/tag/v2.10.21 (x_refsource_MISC)