Overview
DataEase CVE-2026-33082 exposed a SQL injection vulnerability in dataset export where user-controlled values were embedded into SQL fragments without sanitization. Although this CVE is for DataEase, the vulnerability pattern is highly relevant to Node.js (Express) apps that build SQL from user input. Attackers can leverage crafted input in the filtering expression to influence LIKE terms, potentially enabling blind or time-based extraction of database information. This aligns with CWE-89 (SQL Injection) and shows how deserialization of a user-supplied object into SQL fragments can lead to data exposure in real deployments.
In Node.js (Express) apps, similar risks arise when endpoints accept composite input (for example, a filter expression) and concatenate user-provided terms into SQL. If the app deserializes or directly translates that input into a SQL WHERE clause, an attacker can inject in the LIKE pattern or other fragments, bypassing business logic and accessing or mutating data.
Remediation in Node.js relies on eliminating string-concatenated SQL using user input. Use parameterized queries or a safe query builder/ORM, validate input against a defined schema or allowlist, and enforce least-privilege DB accounts. After updating dependencies and code, verify with injection tests and monitor for anomalous query patterns.
DataEase fixed this in version 2.10.21; the lesson applies broadly to Node.js/Express apps that translate user input into SQL without bounds.
Affected Versions
DataEase 2.10.20 and below; fixed in 2.10.21 (CVE-2026-33082). For Node.js/Express code, applicability is about insecure SQL construction patterns, not Node.js versions.
Code Fix Example
Node.js (Express) API Security Remediation
// Vulnerable
app.post('/exportDataset', (req, res) => {
const { expressionTree } = req.body;
const term = extractLikeTerm(expressionTree);
// Vulnerable: user input concatenated into SQL
const sql = "SELECT * FROM dataset WHERE name LIKE '%" + term + "%'";
db.query(sql, (err, rows) => {
if (err) return res.status(500).send('Error');
res.json(rows);
});
});
// Fixed
app.post('/exportDataset', (req, res) => {
const { expressionTree } = req.body;
const term = extractLikeTerm(expressionTree);
// Safe: parameterized query to avoid SQL injection
const sql = "SELECT * FROM dataset WHERE name LIKE ?";
db.query(sql, [`%${term}%`], (err, rows) => {
if (err) return res.status(500).send('Error');
res.json(rows);
});
});