CVE-2026-33121
Published: 16 April 2026
Summary
CVE-2026-33121 is a high-severity SQL Injection (CWE-89) vulnerability in Dataease Dataease. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33121 is a SQL injection vulnerability (CWE-89) in DataEase, an open-source data visualization and analytics platform. It affects versions 2.10.20 and below, specifically in the API datasource saving process. The deTableName field, extracted from a Base64-encoded datasource configuration, is used to construct a DDL statement via simple string replacement without sanitization or escaping of the table name, allowing injection of arbitrary SQL commands.
An authenticated attacker with low privileges (PR:L) can exploit this remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), as reflected in its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). By crafting a deTableName value that breaks out of identifier quoting, the attacker enables error-based SQL injection to extract database information, such as the MySQL version.
The issue has been fixed in DataEase version 2.10.21. Mitigation details are available in the GitHub security advisory (GHSA-fg4m-q7ch-jqv5) and release notes for v2.10.21.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23286
Vulnerability details
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via…
more
simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing DataEase API enables remote exploitation for initial access (T1190) and direct arbitrary queries against the backend database for information collection (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the deTableName input extracted from Base64-encoded datasource configuration to prevent SQL injection into DDL statements.
Mandates timely flaw remediation by applying the patch in DataEase version 2.10.21 to eliminate the unsanitized string replacement vulnerability.
Ensures error handling suppresses database information disclosure exploited in error-based SQL injection attacks via crafted deTableName payloads.