SQL Injection Vulnerability in Chartbrew Open-Source Web Application

CVE-2026-61851

What is CVE-2026-61851?

Chartbrew, an open-source web application for creating charts from databases and APIs, contains a vulnerability related to its runQuery() implementation. Prior to version 5.2.2, the system attempted to limit database access through a blocklist of only seven SQL keywords. This flawed implementation allows an authenticated user with AI feature access to execute potentially dangerous database statements that are not covered by the blocklist. As a result, attackers may exploit this weakness to access or modify files, execute commands, alter database privileges, or compromise sensitive data, depending on the database configuration and user permissions. The vulnerability is remedied in version 5.2.2.

References