Vulnerability Description
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the sorting metadata DTO, which is passed to Order2SQLObj where it is incorporated into the SQL ORDER BY clause without any whitelist validation, and then executed via CalciteProvider. An authenticated attacker can inject arbitrary SQL commands through the sort parameter, enabling time-based blind SQL injection. This issue has been fixed in version 2.10.21.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dataease | Dataease | < 2.10.21 |
Related Weaknesses (CWE)
References
- https://github.com/dataease/dataease/releases/tag/v2.10.21Release Notes
- https://github.com/dataease/dataease/security/advisories/GHSA-r897-r9q8-3p2xExploitThird Party Advisory
FAQ
What is CVE-2026-33084?
CVE-2026-33084 is a vulnerability with a CVSS score of 8.8 (HIGH). DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj end...
How severe is CVE-2026-33084?
CVE-2026-33084 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33084?
Check the references section above for vendor advisories and patch information. Affected products include: Dataease Dataease.