Dataease, an open‑source data visualization tool, contains a classic SQL injection flaw in its /de2api/datasource/previewData endpoint. The tableName query parameter is concatenated directly into an SQL statement with no filtering or parameterization, enabling an attacker to inject arbitrary SQL when providing a crafted table name. This can allow disclosure of sensitive data and, if the attacker writes destructive statements, modification or deletion of database contents. The flaw is classified as CWE‑89.

The vulnerability affects all Dataease releases prior to version 2.10.20. 2.10.20 and later contain the remediation that parameterizes the SQL query. The API endpoint /de2api/datasource/previewData is the entry point for the vulnerability.

With a CVSS score of 9.3 the issue is considered critical. The EPSS score is noted as less than 1%, indicating a low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the /de2api/datasource/previewData endpoint. If the endpoint is publicly reachable or an authenticated user can trigger it, the attacker can supply a malicious tableName value to execute arbitrary SQL. The impact scope is full database access, which could compromise confidentiality and integrity of all stored data.