This vulnerability exists in Dataease 2.10.20 specifically in the SqlparserUtils.transFilter function of the Data Dashboard component. Improper input handling allows an attacker with high privileges to perform SQL injection remotely. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1, reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. The vendor was notified early, but no official fix or mitigation details are currently available.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification within the affected Dataease instance. The impact is limited by the requirement for high privileges and the low confidentiality, integrity, and availability impact metrics. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Dataease version 2.10.20 to trusted users only, and monitor for suspicious activity related to SQL query manipulation. Avoid exposing the vulnerable component to untrusted networks if possible.