Is CVE-2026-41518 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41518 being exploited in the wild.

How severe is CVE-2026-41518?

High severity, with a CVSS score of 7.6, published 4 June 2026.

Which products and versions are affected?

Chartbrew Chartbrew 4.9.0 through 5.0.0.

Is there a fix for CVE-2026-41518?

A patch was published on 2026-05-20: Version 5.0.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41518 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41518?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41518: Chartbrew stored DOM XSS in chart legend tooltips

CVE-2026-41518 · Severity: high · CVSS 7.6 · Published 2026-06-04

Chartbrew is an open-source platform used to create visual dashboards by connecting to databases and APIs. A security flaw allows users with "editor" permissions to embed malicious code into chart legends. When any other person views the resulting dashboard, this code runs automatically in their browser, potentially allowing attackers to steal login tokens, capture keystrokes, or redirect users to fraudulent sites.

Quick answers

Is CVE-2026-41518 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41518 being exploited in the wild.
How severe is CVE-2026-41518?: High severity, with a CVSS score of 7.6, published 4 June 2026.
Which products and versions are affected?: Chartbrew Chartbrew 4.9.0 through 5.0.0.
Is there a fix for CVE-2026-41518?: A patch was published on 2026-05-20: Version 5.0.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41518 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41518?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Chartbrew versions 4.9.0 to 5.0.0 due to improper sanitization of the 'ChartDatasetConfig.legend' field. The field is stored as raw text in the Sequelize database and subsequently rendered in the frontend using an unguarded 'innerHTML' assignment within 'ChartTooltip.js'. An authenticated attacker with project-editor privileges can inject a malicious payload that executes automatically when any user (including unauthenticated public viewers) loads a dashboard containing the affected chart. The vulnerability affects Bar, Line, Area, and Matrix charts that share the tooltip rendering logic. A fix is available in version 5.0.1.

Affected products

Chartbrew Chartbrew 4.9.0 through 5.0.0

Timeline

2026-05-20: advisory: GitHub Security Advisory published by maintainer
2026-06-04: disclosed: CVE published to NVD
2026-05-20: patched: Version 5.0.1 released with fix

References

https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6q2j-365c-7gqf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.