Executive brief
Chartbrew is an open-source web application that connects to databases and APIs to create charts. A vulnerability in versions before 5.2.2 allows authenticated users to inject arbitrary SQL code by manipulating the row_limit parameter in AI-driven queries, potentially allowing attackers to read, modify, or delete data in the connected database, or execute operating system commands if database permissions allow.
Technical details
The runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js fails to validate the row_limit parameter as an integer before interpolating it into a SQL LIMIT clause. The read-only keyword check runs before the row_limit is appended, allowing authenticated users to bypass the check by injecting SQL through a non-integer row_limit value. An attacker with authentication can exploit this to execute arbitrary SQL statements with the database connection's privileges.
Affected products
- Chartbrew Chartbrew before 5.2.2
Timeline
- 2026-09-21: disclosed
- 2026-06-18: patched: Fix committed; version 5.2.2 released 2026-06-24