Chartbrew up to 5.2.2 ClickHouse protocol clickhouse.protocol.js applySqlVariables sql injection

Summaryinfo

A vulnerability marked as critical has been reported in Chartbrew up to 5.2.2. Affected by this issue is the function applySqlVariables of the file server/sources/plugins/clickhouse/clickhouse.protocol.js of the component ClickHouse protocol. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2026-65980. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Chartbrew up to 5.2.2. This affects the function applySqlVariables of the file server/sources/plugins/clickhouse/clickhouse.protocol.js of the component ClickHouse protocol. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. For a ClickHouse-backed chart with variable binding, an attacker can supply a backslash before a quote so quote doubling does not keep the value within its intended SQL string literal. Public dashboards can expose this path without authentication, and successful exploitation can execute arbitrary ClickHouse SQL to disclose data or, when the database configuration permits, access files or internal network resources. This issue is fixed in version 5.2.3.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-65980 since 07/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 5.2.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Chartbrew

Version

• 5.2.0
• 5.2.1
• 5.2.2

Website

• Product: https://github.com/chartbrew/chartbrew/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion