DataEase is an open‑source data visualization platform that uses a SQL endpoint allowing user‑supplied queries. A flaw in the /de2api/datasetData/previewSql route wraps the input in a subquery but does not enforce that the input is a single SELECT statement. Combined with a JDBC blocklist bypass that enables allowMultiQueries=true, an attacker can exit the subquery and execute arbitrary stacked SQL statements, including writes, against the connected database. Because the attacker must be authenticated with valid datasource credentials, successful exploitation grants full read and write access to the underlying database.

DataEase instances running version 2.10.20 or earlier are vulnerable. The issue was addressed in release 2.10.21. All other versions are not affected.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS is not available, but the fact that it is not listed in the KEV catalog suggests no publicly known exploits at this time. The attacker must possess authenticated access to a valid datasource, which limits the risk to customers who expose such credentials. Nevertheless, those credentials can provide complete control over the underlying database, enabling data theft, modification, or destruction.