CVE-2026-65980 in Chartbrew
Summary
by MITRE • 09/22/2026
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. For a ClickHouse-backed chart with variable binding, an attacker can supply a backslash before a quote so quote doubling does not keep the value within its intended SQL string literal. Public dashboards can expose this path without authentication, and successful exploitation can execute arbitrary ClickHouse SQL to disclose data or, when the database configuration permits, access files or internal network resources. This issue is fixed in version 5.2.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
Chartbrew serves as an open-source web application designed to aggregate data from various databases and APIs for visualization purposes. A critical security flaw exists within its ClickHouse protocol implementation prior to version 5.2.3, specifically located in the file server/sources/plugins/clickhouse/clickhouse.protocol.js. The vulnerability stems from a failure to properly sanitize user-supplied input when constructing SQL queries through variable binding mechanisms. When processing requests for charts backed by ClickHouse databases, the application invokes the applySqlVariables function defined in server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash configuration option. This omission creates a pathway for attackers to manipulate how string literals are processed within the underlying database engine.
The technical core of this vulnerability lies in the handling of backslashes preceding quote characters in user-controlled input fields used for variable binding. In standard SQL injection mitigation strategies, escaping special characters is essential to ensure that user input remains strictly within its intended context as a data value rather than being interpreted as executable code. By failing to escape backslashes, Chartbrew allows an attacker to supply a sequence such as a backslash followed by a quote character. This specific payload disrupts the expected string literal boundaries because the database engine may interpret the escaped quote differently or fail to properly close the original string context depending on the SQL dialect's parsing rules. Consequently, this manipulation prevents quote doubling from effectively containing the malicious value within its intended SQL string literal scope.
This flaw is particularly dangerous in environments where public dashboards are enabled without requiring authentication. Since these endpoints are accessible to unauthenticated users, an attacker can remotely exploit the vulnerability by crafting specific HTTP requests that inject malformed variable bindings into chart configurations. The operational impact of successful exploitation includes arbitrary ClickHouse SQL execution on behalf of the database user account running the Chartbrew service. Depending on the privileges granted to this database account and the configuration of the underlying ClickHouse instance, an attacker can read sensitive data from tables, exfiltrate information stored in the database, or potentially leverage server-side request forgery capabilities inherent in some database engines to access internal network resources. In severe cases where file system permissions allow it, such as through specific functions like loadFile or similar mechanisms available in ClickHouse, attackers might even attempt to read arbitrary files from the host operating system.
The vulnerability aligns with Common Weakness Enumeration CWE-89, which covers Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. Furthermore, it maps to MITRE ATT&CK technique T1059, specifically subtechniques related to command and script interpretation or database commands, depending on the exact execution vector utilized by the attacker during exploitation. The lack of proper input validation and escaping represents a fundamental failure in secure coding practices for web applications interacting with relational databases.
To mitigate this risk, organizations using Chartbrew must upgrade immediately to version 5.2.3 or later, where the escapeBackslash option is correctly enabled within the SQL variable processing logic. For deployments that cannot be upgraded instantly due to compatibility constraints, administrators should restrict access to public dashboards by enforcing authentication and authorization controls. Additionally, implementing a Web Application Firewall with rules capable of detecting anomalous SQL injection patterns involving backslashes and quotes can provide an additional layer of defense. Database-level security measures such as least privilege principles for the Chartbrew service account further limit the potential blast radius should exploitation occur. Regular code audits focusing on dynamic query construction are also recommended to prevent similar vulnerabilities in other data source plugins or future updates.