CVE-2026-65980 Details
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. For a ClickHouse-backed chart with variable binding, an attacker can supply a backslash before a quote so quote doubling does not keep the value within its intended SQL string literal. Public dashboards can expose this path without authentication, and successful exploitation can execute arbitrary ClickHouse SQL to disclose data or, when the database configuration permits, access files or internal network resources. This issue is fixed in version 5.2.3.
A SQL injection vulnerability has been identified in Chartbrew versions prior to 5.2.3, specifically within the ClickHouse data source plugin. The issue arises because the variable substitution function does not properly escape backslashes in user-supplied variable values for ClickHouse queries. This oversight allows an attacker to manipulate SQL string literals and inject arbitrary SQL commands. Public dashboards can be exploited without authentication, potentially leading to unauthorized data access or file retrieval.
Users are advised to update to Chartbrew version 5.2.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chartbrew/chartbrew/commit/5f95d07b5fee7f69c9d1242b5c99ea11ff046341 | [email protected] | Source CodeVendor |
| https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3 | [email protected] | Release NotesVendor |
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-5jgv-45cw-hc53 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chartbrew | <= 5.2.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | New CVE Received | [email protected] |