# CVE-2026-61852: Chartbrew SQL injection via unvalidated row_limit parameter

Source: https://junglewise.ai/threats/cve-2026-61852-chartbrew-is-an-open-source-web-application-that-can-connect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-61852 · Severity: info · Published 2026-09-21

Chartbrew is an open-source web application that connects to databases and APIs to create charts. A vulnerability in versions before 5.2.2 allows authenticated users to inject arbitrary SQL code by manipulating the row_limit parameter in AI-driven queries, potentially allowing attackers to read, modify, or delete data in the connected database, or execute operating system commands if database permissions allow.

Technologies: [Chartbrew](https://junglewise.ai/threats/technologies/chartbrew-chartbrew). Vendors: [Chartbrew](https://junglewise.ai/threats/vendors/chartbrew).

## Quick answers

**Is CVE-2026-61852 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61852 being exploited in the wild.

**How severe is CVE-2026-61852?** Informational severity, published 21 September 2026.

**Which products and versions are affected?** Chartbrew before 5.2.2.

**Is there a fix for CVE-2026-61852?** A patch was published on 2026-06-18: Fix committed; version 5.2.2 released 2026-06-24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61852 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-61852?** Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js fails to validate the row_limit parameter as an integer before interpolating it into a SQL LIMIT clause. The read-only keyword check runs before the row_limit is appended, allowing authenticated users to bypass the check by injecting SQL through a non-integer row_limit value. An attacker with authentication can exploit this to execute arbitrary SQL statements with the database connection's privileges.

## Affected products

- Chartbrew Chartbrew before 5.2.2

## Timeline

- 2026-09-21: disclosed
- 2026-06-18: patched: Fix committed; version 5.2.2 released 2026-06-24

## References

- [https://github.com/chartbrew/chartbrew/commit/8c8412edce56093e81b524e0235a796c7dd42336](https://github.com/chartbrew/chartbrew/commit/8c8412edce56093e81b524e0235a796c7dd42336)
- [https://github.com/chartbrew/chartbrew/releases/tag/v5.2.2](https://github.com/chartbrew/chartbrew/releases/tag/v5.2.2)

## Related threats

- [Chartbrew AI SQL blocklist bypass in PostgreSQL query validation](https://junglewise.ai/threats/cve-2026-69128-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew API connection private host bypass](https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts)
- [Chartbrew dashboard password brute force via plaintext storage](https://junglewise.ai/threats/cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew BullMQ dashboard authentication bypass](https://junglewise.ai/threats/cve-2026-86005-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew arbitrary file deletion via connection cleanup](https://junglewise.ai/threats/cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect)