Unrated severityNVD Advisory· Published Mar 12, 2026· Updated Mar 13, 2026
DataEase SQL Injection Vulnerability
CVE-2026-32137
Description
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/dataease/dataease/security/advisories/GHSA-vgm2-269h-8624mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.