Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

chartbrew — Vulnerabilities & Security Advisories 30

Browse all 30 CVE security advisories affecting chartbrew. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Chartbrew is an open-source data visualization tool that allows users to create and manage dashboards by connecting to various data sources. Historically, it has been affected by multiple vulnerabilities including remote code execution (RCE), cross-site scripting (XSS), and privilege escalation flaws, often stemming from improper input validation and insecure authentication mechanisms. The tool's 14 recorded CVEs highlight recurring issues in its API endpoints and dashboard components, with some instances allowing unauthorized access to sensitive data. While no major public security incidents have been widely documented, the consistent pattern of vulnerabilities suggests a need for rigorous security testing and input sanitization to prevent potential exploitation.

Top products by chartbrew: chartbrew
CVE ID Title CVSS Severity Published
CVE-2026-69128 Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap) — chartbrew CWE-22 4.6 Medium 2026-11-06
CVE-2026-68935 Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections — chartbrew CWE-918 9.1 Critical 2026-11-06
CVE-2026-68933 Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage — chartbrew CWE-307 7.5 High 2026-11-06
CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew — chartbrew CWE-306 9.3 Critical 2026-11-06
CVE-2026-85736 Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths — chartbrew CWE-73 8.1 High 2026-11-06
CVE-2026-85726 Chartbrew: Blind NoSQL injection via date variable in embedded chart — chartbrew CWE-943 7.5 High 2026-11-06
CVE-2026-85712 Chartbrew: Cross-tenant project takeover via body.team_id in /project routes — chartbrew CWE-639 8.8 High 2026-11-06
CVE-2026-85708 Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens — chartbrew CWE-347 7.5 High 2026-11-06
CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET — chartbrew CWE-1394 9.8 Critical 2026-11-06
CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution — chartbrew CWE-89 9.8 Critical 2026-11-06
CVE-2026-54589 Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl) — chartbrew CWE-918 7.0 High 2026-11-06
CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution — chartbrew CWE-89 7.9 High 2026-09-21
CVE-2026-61851 Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool — chartbrew CWE-184 6.5 Medium 2026-09-21
CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool — chartbrew CWE-89 5.8 Medium 2026-09-21
CVE-2026-61743 Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation — chartbrew CWE-350 6.3 Medium 2026-09-21
CVE-2026-41518 Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) — chartbrew CWE-79 7.6 High 2026-06-04
CVE-2026-40603 Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override — chartbrew CWE-284 6.5 Medium 2026-04-30
CVE-2026-40601 Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle — chartbrew CWE-862 7.5 High 2026-04-30
CVE-2026-40600 Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id — chartbrew CWE-639 8.1 High 2026-04-30
CVE-2026-40595 Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks — chartbrew CWE-284 7.5 High 2026-04-30
CVE-2026-35514 Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew — chartbrew CWE-306 6.5 Medium 2026-04-30
CVE-2026-40904 Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks — chartbrew CWE-284 8.1 High 2026-04-30
CVE-2026-32252 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` — chartbrew CWE-285 7.7 High 2026-04-10
CVE-2026-30232 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs — chartbrew CWE-918 8.1 - 2026-04-10
CVE-2026-27605 Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API — chartbrew CWE-434 6.3 Medium 2026-03-06
CVE-2026-27603 Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions — chartbrew CWE-306 5.3 - 2026-03-06
CVE-2026-27005 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) — chartbrew CWE-89 9.1 - 2026-03-06
CVE-2026-25888 Chartbrew: Remote Code Execution (RCE) via Vulnerable API — chartbrew CWE-94 8.8 High 2026-03-06
CVE-2026-25887 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query — chartbrew CWE-94 7.2 High 2026-03-06
CVE-2026-25877 Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations — chartbrew CWE-284 6.5 Medium 2026-03-06

This page lists every published CVE security advisory associated with chartbrew. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.