CVE-2026-41518 Details
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In versions 4.9.0 through 5.0.0, an authenticated user with project-editor permissions can store arbitrary HTML/JavaScript in the `ChartDatasetConfig.legend` field. The payload is persisted verbatim in the database, propagated through the Chart.js rendering pipeline, and injected into the tooltip DOM element via an unguarded `innerHTML` assignment in `ChartTooltip.js`. Every unauthenticated viewer of the public dashboard triggers JavaScript execution on page load — no hover interaction is required. Browser-based Playwright verification confirmed `alert('localhost')` fires immediately and `<img src="x" onerror="alert(document.domain)">` is present in the `#chartjs-tooltip` DOM element. Version 5.0.1 contains a fix.
A stored cross-site scripting vulnerability has been identified in Chartbrew versions 4.9.0 prior to 5.0.0. This issue allows authenticated users with project-editor permissions to inject arbitrary HTML and JavaScript into the 'ChartDatasetConfig.legend' field. The injected payload is saved directly into the database and later executed as JavaScript by unauthenticated viewers of the public dashboard, without any required interaction. The vulnerability arises from the absence of server-side validation or sanitization of the legend field, which is treated as raw text. The exploitation is confirmed to work with various types of charts that utilize the shared tooltip plugin.
Users can upgrade to Chartbrew version 5.0.1, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6q2j-365c-7gqf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6q2j-365c-7gqf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chartbrew | 4.9.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |