Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-61851

Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

CVSS 4.0 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-61851

Published

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist containing only seven SQL keywords. An authenticated user with AI feature access can submit dangerous statements or database functions that are absent from the read-only keyword blocklist, causing them to execute without SQL injection or keyword-obfuscation techniques. Depending on the database engine, configuration, and database-user privileges, this can expose or write files, access internal network resources, change database privileges, execute commands, or alter data. This issue is fixed in version 5.2.2.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-61851

Published

chartbrew

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "chartbrew",
                    "product": "chartbrew",
                    "versions": [
                        {
                            "version": "< 5.2.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON