SQL Injection Vulnerability in Chartbrew Web Application by Chartbrew

CVE-2026-65980

What is CVE-2026-65980?

Chartbrew, an open-source web application designed for connecting to databases and APIs for data visualization, introduces a vulnerability due to improper handling of SQL variables. In versions prior to 5.2.3, the application’s handling of the ClickHouse protocol does not enable the escapeBackslash option while calling SQL variable functions. This oversight allows an attacker to exploit public dashboards—often unauthenticated—by injecting backslashes before quotes, leading to potential SQL injection attacks. By manipulating SQL queries, an attacker can access sensitive data or internal resources, depending on the database configuration. This issue has been rectified in version 5.2.3.

References