CVE-2026-33121

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple string replacement without any sanitization or escaping of the table name. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information such as the MySQL version. This issue has been fixed in version 2.10.21.

• CWE-89

• https://github.com/dataease/dataease/releases/tag/v2.10.21Release Notes
• https://github.com/dataease/dataease/security/advisories/GHSA-fg4m-q7ch-jqv5Exploit, Third Party Advisory
• https://github.com/dataease/dataease/security/advisories/GHSA-fg4m-q7ch-jqv5Exploit, Third Party Advisory

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33115Use after free in Microsoft Office Word allows an unauthoriz…8.4
• CVE-2026-33116Loop with unreachable exit condition ('infinite loop') in .N…7.5
• CVE-2026-33117The Java Key Vault Keys library in the Azure SDK for Java co…9.1
• CVE-2026-33118User interface (ui) misrepresentation of critical informatio…4.3
• CVE-2026-33119User interface (ui) misrepresentation of critical informatio…5.4
• CVE-2026-33120Untrusted pointer dereference in SQL Server allows an author…8.8
• CVE-2026-33122DataEase is an open-source data visualization and analytics …9.8
• CVE-2026-33123pypdf is a free and open-source pure-python PDF library. Ver…6.5
• CVE-2026-33124Frigate is a network video recorder (NVR) with realtime loca…8.8
• CVE-2026-33125Frigate is a network video recorder (NVR) with realtime loca…8.1
• CVE-2026-33126Frigate is a network video recorder (NVR) with realtime loca…4.3
• CVE-2026-33128H3 is a minimal H(TTP) framework. In versions prior to 1.15.…10