CVE-2026-61852 Details
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's row_limit parameter into a SQL LIMIT clause without runtime integer validation. The read-only keyword check runs before this value is appended, so an authenticated user who can influence a model-generated non-integer row_limit can add SQL that bypasses the earlier check. Successful exploitation can execute arbitrary statements against the connected database, including reading or changing data and, where database permissions permit, accessing files or executing operating-system commands. This issue is fixed in version 5.2.2.
A SQL injection vulnerability has been identified in Chartbrew versions prior to 5.2.2. The issue arises in the AI orchestrator's runQuery tool, where the row_limit parameter is directly inserted into SQL queries without proper integer validation. This flaw allows authenticated users to inject SQL that bypasses security checks, potentially leading to unauthorized data access or manipulation. Exploitation is possible by manipulating model-generated inputs to include malicious SQL, which is then executed on the connected database.
Users are advised to update to Chartbrew version 5.2.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4923-m569-jc42 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/chartbrew/chartbrew/commit/8c8412edce56093e81b524e0235a796c7dd42336 | [email protected] | Source CodeVendor |
| https://github.com/chartbrew/chartbrew/releases/tag/v5.2.2 | [email protected] | Release NotesVendor |
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4923-m569-jc42 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chartbrew | <= 5.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |