CVE-2026-41518: Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In versions 4.9.0 through 5.0.0, an authenticated user with project-editor permissions can store arbitrary HTML/JavaScript in the ChartDatasetConfig.legend field. The payload is persisted verbatim in the database, propagated through the Chart.js rendering pipeline, and injected into the tooltip DOM element via an unguarded innerHTML assignment in ChartTooltip.js. Every unauthenticated viewer of the public dashboard triggers JavaScript execution on page load — no hover interaction is required. Browser-based Playwright verification confirmed alert('localhost') fires immediately and <img src="x" onerror="alert(document.domain)"> is present in the #chartjs-tooltip DOM element. Version 5.0.1 contains a fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41518?
The severity of CVE-2026-41518 is classified as high with a score of 7.6.
How do I fix CVE-2026-41518?
To fix CVE-2026-41518, upgrade to Chartbrew version 5.0.1 or later.
What type of vulnerability is CVE-2026-41518?
CVE-2026-41518 is a stored DOM XSS vulnerability.
Who is affected by CVE-2026-41518?
Authenticated users with project-editor permissions in Chartbrew versions 4.9.0 through 5.0.0 are affected by CVE-2026-41518.
What can an attacker do with CVE-2026-41518?
An attacker can store arbitrary HTML/JavaScript in the ChartDatasetConfig.legend field, potentially leading to malicious script execution.