Chartbrew SQL injection in dashboard filter substitution

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…rtbrew/security/advisories/GHSA-4wj7-9gq7-mrr2 Diğer
• github.com/…ommit/f93d31ac586091f72a7eb97d89fa3b4db271bd24 Diğer
• github.com/chartbrew/chartbrew/releases/tag/v5.2.1 Diğer

Kayıt geçmişi

1. 7 Kas 2026 00:04Yayımlandı

İlgili açıklar

• 4,6 CVE-2026-69128Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted…
• 9,1 CVE-2026-68935Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections
• 7,5 CVE-2026-68933Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage
• 9,3 CVE-2026-86005Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew
• 8,1 CVE-2026-85736Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths
• 7,5 CVE-2026-85726Chartbrew: Blind NoSQL injection via date variable in embedded chart