Unrated severityNVD Advisory· Published Mar 12, 2026· Updated Mar 13, 2026
DataEase SQL Injection Vulnerability
CVE-2026-32137
Description
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
1- github.com/dataease/dataease/security/advisories/GHSA-vgm2-269h-8624mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.