CVE-2026-33122 is a critical (CVSS 9.8) SQL injection in DataEase, the open-source data visualization platform. Versions 2.10.20 and below pass a user-supplied table name into a CREATE TABLE statement without escaping. The fix is DataEase 2.10.21, so upgrade and review who can edit datasources.
What's affected
DataEase versions 2.10.20 and below. The GitHub advisory (GHSA-28vg-3hv7-w92f) lists the Maven package io.dataease with affected versions below 2.10.21 and the patched version 2.10.21.
The flaw sits in the API datasource update path, reached through the /de2api/datasource/update endpoint.
How to check if you're exposed
Open the DataEase admin console and read the version from the About or system information page, or check the image tag or release package you deployed. Anything at or below 2.10.20 is affected.
If you run it in containers, list the image tags in use:
docker ps
Also check whether the datasource update endpoint is reachable from networks you do not trust.
What to do now
- Upgrade DataEase to 2.10.21 or later.
- Restrict access to the DataEase admin interface and the /de2api paths to trusted networks or a VPN until you have upgraded.
- Review which accounts can create or edit API datasources, and remove access that is not needed.
- Check database and application logs for odd table names or SQL errors around datasource updates.
Why it matters
The weakness is CWE-89, SQL injection. Per the advisory, the deTableName field comes straight from the submitted datasource configuration and is substituted into a table creation statement with no identifier escaping. A crafted name can break out of the identifier quoting and change the statement.
The advisory describes the result as error based injection that can extract database information. The advisory text says the attacker must be authenticated, although the NVD vector lists no privileges required, so treat the exposure as serious either way. The record does not mark this CVE as listed in CISA KEV.
Quick check
Is there a workaround if I cannot upgrade today?
The advisory points to the patched release. Until you can upgrade, limit network access to the admin interface and limit who can edit datasources.
Sources
Last reviewed: 19 October 2026.
