Vulnerability · Published Apr 16, 2026 · Assigned by GitHub_M

CVE-2026-40900DataEase has SQL Injection via Stacked Queries

High 8.7

In plain English

A high-severity SQL injection in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 72.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling allowMultiQueries=true, an attacker can break out of the subquery and execute arbitrary stacked SQL statements, including UPDATE and other write operations, against the connected database. An authenticated attacker with access to valid datasource credentials can achieve full read and write access to the underlying database. This issue has been fixed in version 2.10.21.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.21

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-vqxf-84ph-j3vx x_refsource_CONFIRM
https://github.com/dataease/dataease/releases/tag/v2.10.21 x_refsource_MISC