DataEase versions 2.10.20 and earlier contain a SQL injection flaw in the datasource save API. The deTableName field of the Base64‑encoded datasource configuration is directly embedded into a DDL statement via simple string replacement, with no sanitization. An attacker who is authenticated and has permission to save datasources can craft a deTableName that breaks out of the identifier quotation and injects arbitrary SQL, enabling error‑based extraction of database information such as the MySQL version. This is a classic input‑validation weakness, listed as CWE‑89.

The vulnerability affects the DataEase open‑source data visualization platform. All instances running version 2.10.20 or earlier are affected. The issue was resolved in the 2.10.21 release; no other product versions are affected according to the vendor advisory.

The CVSS base score is 8.7, indicating a High severity vulnerability. Exploitation requires authenticated access with permission to create or modify datasources, limiting the attack surface but still presenting a significant risk. No EPSS data is published, and the flaw is not listed in the CISA KEV catalog, but the high severity and potential for information disclosure warrant immediate attention.