CVE-2026-33082 is a critical (CVSS 9.8) SQL injection in DataEase, the open source data visualization tool, in versions 2.10.20 and below. A filter value in the dataset export request is placed into SQL without sanitizing. DataEase 2.10.21 fixes it, so upgrade.
What's affected
Per the GitHub advisory, the Maven package io.dataease is affected before 2.10.21, and 2.10.21 is the patched version. The NVD record gives the same boundary: 2.10.20 and below.
The vulnerable route is the dataset export endpoint, /de2api/datasetTree/exportDataset, according to the advisory.
How to check if you're exposed
Find the DataEase version in the admin interface or in your deployment files, such as the container image tag or the compose file. If you build from source and use Maven, check dependencies:
mvn dependency:tree | grep dataease
Also check whether the DataEase API is reachable from untrusted networks. The CVSS vector lists network access with no privileges.
What to do now
- Upgrade DataEase to 2.10.21 or later.
- Restrict access to the application to trusted networks until the upgrade is done.
- Review web and database logs for odd requests to the export endpoint and for long running queries.
- Check what the database account used by DataEase can read, and reduce it to the minimum.
Why it matters
The weakness class is CWE-89. The advisory says the export request carries a filter tree, and when a filter term uses a like comparison the value is concatenated into the SQL fragment. A crafted value can break out of the string literal.
The advisory calls it blind SQL injection, meaning results are inferred from side effects such as timing rather than returned directly. That is slower for an attacker but still reaches the data. DataEase connects to other data sources, so the database it queries can hold sensitive business data. A second DataEase flaw, CVE-2026-33122, is a separate SQL injection in datasource updates. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
DataEase 2.10.21, according to both the advisory and the NVD record.
What is blind SQL injection?
It is SQL injection where the attacker does not see query output directly and instead learns data from behavior such as response time.
Sources
Last reviewed: 19 October 2026.
