CVE-2026-33207

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the tableName parameter directly into SQL query strings using String.format without parameterization or sanitization. Although DatasourceServer.java validates that the table name exists in the datasource, an attacker can bypass this by first registering an API datasource with a malicious deTableName, which is then returned by getTables and passes the validation check. An authenticated attacker can execute arbitrary SQL commands, enabling error-based extraction of sensitive database information. This issue has been fixed in version 2.10.21.

• CWE-89

• https://github.com/dataease/dataease/releases/tag/v2.10.21Release Notes
• https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmmExploit, Third Party Advisory
• https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmmExploit, Third Party Advisory

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33201Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., L…7
• CVE-2026-33202Active Storage allows users to attach cloud and local files …9.1
• CVE-2026-33203SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-33204SimpleJWT is a simple JSON web token library written in PHP.…7.5
• CVE-2026-33205calibre is a cross-platform e-book manager for viewing, conv…5.5
• CVE-2026-33206calibre is a cross-platform e-book manager for viewing, conv…6.3
• CVE-2026-33208Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…8.8
• CVE-2026-33209Avo is a framework to create admin panels for Ruby on Rails …6.1
• CVE-2026-3321A vulnerability of authorization bypass through user-control…8.7
• CVE-2026-33210Ruby JSON is a JSON implementation for Ruby. From version 2.…9.1
• CVE-2026-33211Tekton Pipelines project provides k8s-style resources for de…9.6
• CVE-2026-33212Weblate is a web based localization tool. In versions prior …3.1