A blind SQL injection flaw exists in the dataset export endpoint of DataEase. The parameter named expressionTree is deserialized into a filtering object and then translated into SQL. User‑controlled values in "like" filter terms are concatenated directly into the SQL statement without proper sanitization, creating a classic injection point identified by CWE‑89. An attacker can escape the string literal within a filter value and inject arbitrary SQL commands, enabling techniques such as time‑based queries to extract database information. The impact is the potential exposure of sensitive data stored in the database and the possibility of further exploitation via data manipulation.

This vulnerability affects the open‑source DataEase data visualization tool, specifically version 2.10.20 and all prior releases. The issue is fixed in version 2.10.21, so any deployment running v2.10.20 or older is susceptible.

The flaw carries a high CVSS score of 8.7, indicating substantial severity. The EPSS score is unavailable, so it is treated as unknown. There is no KEV listing, which suggests that widespread public exploitation has not been documented. Because the vulnerable endpoint is a remote HTTP POST, an attacker may craft a malicious expressionTree payload and send a request to /de2api/datasetTree/exportDataset. Whether authentication is required to access this endpoint is not disclosed in the CVE data; it is inferred that successful exploitation would require the attacker to reach the endpoint, potentially by having valid credentials or by exploiting open access. Once the payload reaches the backend, SQL commands can be injected into the database, allowing data extraction or modification.