CVE-2026-61852 - Chartbrew SQL Injection Vulnerability

CVE-2026-61852 - Chartbrew: SQL Injection Vulnerability

Chartbrew is an open-source web application that connects directly to databases and APIs to create charts. A critical vulnerability, CVE-2026-61852, has been identified in this application.

Prior to version 5.2.2, Chartbrew’s runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool’s row_limit parameter into a SQL LIMIT clause without runtime integer validation. The read-only keyword check runs before this value is appended, meaning an authenticated user can influence a model-generated non-integer row_limit and add SQL that bypasses the earlier check.

Impact

Successful exploitation of this flaw can execute arbitrary statements against the connected database, including reading or changing data and, where database permissions permit, accessing files or executing operating-system commands. This issue is fixed in version 5.2.2.

The vulnerability has been classified under CWE-89, denoting an Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’).

References

For further technical analysis and mitigation steps, several references are available:

• GitHub commit implementing the fix
• Release tag v5.2.2 where the fix was applied
• Official Chartbrew security advisory

To read the complete article see: Read full article

🚀 Stay informed and secure!