CVE-2026-33122

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource update process. When a new table definition is added during a datasource update via /de2api/datasource/update, the deTableName field from the user-submitted configuration is passed to DatasourceSyncManage.createEngineTable, where it is substituted into a CREATE TABLE statement template without any sanitization or identifier escaping. An authenticated attacker can inject arbitrary SQL commands by crafting a deTableName that breaks out of identifier quoting, enabling error-based SQL injection that can extract database information. This issue has been fixed in version 2.10.21.

• CWE-89

• https://github.com/dataease/dataease/releases/tag/v2.10.21Product, Release Notes
• https://github.com/dataease/dataease/security/advisories/GHSA-28vg-3hv7-w92fExploit, Vendor Advisory

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33116Loop with unreachable exit condition ('infinite loop') in .N…7.5
• CVE-2026-33117The Java Key Vault Keys library in the Azure SDK for Java co…9.1
• CVE-2026-33118User interface (ui) misrepresentation of critical informatio…4.3
• CVE-2026-33119User interface (ui) misrepresentation of critical informatio…5.4
• CVE-2026-33120Untrusted pointer dereference in SQL Server allows an author…8.8
• CVE-2026-33121DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-33123pypdf is a free and open-source pure-python PDF library. Ver…6.5
• CVE-2026-33124Frigate is a network video recorder (NVR) with realtime loca…8.8
• CVE-2026-33125Frigate is a network video recorder (NVR) with realtime loca…8.1
• CVE-2026-33126Frigate is a network video recorder (NVR) with realtime loca…4.3
• CVE-2026-33128H3 is a minimal H(TTP) framework. In versions prior to 1.15.…10
• CVE-2026-33129H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 thro…5.9