CVE-2026-33084

DataEase versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The vulnerability stems from insufficient input validation where user-supplied sort values are directly incorporated into SQL ORDER BY clauses without whitelist verification, allowing authenticated attackers to inject arbitrary SQL commands and execute time-based blind SQL injection attacks. This issue has been remediated in version 2.10.21. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH), indicating significant risk. It requires network access and valid authentication credentials but involves low attack complexity. The impact is severe across all security dimensions: confidentiality, integrity, and availability are all rated as HIGH, meaning attackers could potentially exfiltrate sensitive data, modify database contents, and disrupt service availability. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists. The EPSS score of 0.00034 suggests a very low probability of exploitation in the next 30 days relative to other CVEs. Organizations should prioritize patching to version 2.10.21, particularly if DataEase is internet-facing or accessible to untrusted network segments.