CVE-2026-61851

Received Received - Intake

Chartbrew Remote Code Execution via Bypassed Read-Only SQL Queries

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist containing only seven SQL keywords. An authenticated user with AI feature access can submit dangerous statements or database functions that are absent from the read-only keyword blocklist, causing them to execute without SQL injection or keyword-obfuscation techniques. Depending on the database engine, configuration, and database-user privileges, this can expose or write files, access internal network resources, change database privileges, execute commands, or alter data. This issue is fixed in version 5.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-61851

Affected Vendors & Products

Vendor	Product	Version / Range
chartbrew	chartbrew	5.2.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

Chartbrew before 5.2.2 has a flawed read-only enforcement in its runQuery() function. It uses a blocklist of only seven SQL keywords to prevent write operations, but this is insufficient. Authenticated users with AI feature access can bypass these restrictions by submitting dangerous SQL statements or functions not included in the blocklist. This allows execution of unauthorized commands depending on database configuration and user privileges.

Detection Guidance

To detect this vulnerability, check if your Chartbrew instance is running a version prior to 5.2.2. Inspect the server/modules/ai/orchestrator/tools/runQuery.js file for the presence of the read-only keyword blocklist. If the blocklist is incomplete or missing, the system may be vulnerable.

Impact Analysis

If you use Chartbrew versions before 5.2.2, an attacker with AI access could read sensitive data, modify or delete database contents, execute system commands, or access internal network resources. The impact depends on your database setup and user permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance failures may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade Chartbrew to version 5.2.2 or later immediately. Review database user permissions to ensure least privilege. Monitor for unusual database queries or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-61851. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70