CVE-2026-65980: Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. For a ClickHouse-backed chart with variable binding, an attacker can supply a backslash before a quote so quote doubling does not keep the value within its intended SQL string literal. Public dashboards can expose this path without authentication, and successful exploitation can execute arbitrary ClickHouse SQL to disclose data or, when the database configuration permits, access files or internal network resources. This issue is fixed in version 5.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
Which deployments are exposed without authentication?
Public dashboards backed by ClickHouse charts that use variable binding can expose the vulnerable path to unauthenticated users. Deployments without public dashboards may still be affected if an attacker can access a chart and control its variable values.
What input is needed to exploit the issue?
An attacker must be able to supply a chart variable value and include a backslash before a quote. In the affected ClickHouse variable-substitution path, this can escape the intended SQL string literal and permit arbitrary ClickHouse SQL execution.
Are default ClickHouse capabilities enough for the most severe impacts?
SQL execution can disclose data, while file access or access to internal network resources depends on the ClickHouse database configuration permitting those capabilities. The available information does not establish that those additional capabilities are enabled by default.
What version fixes the issue?
Chartbrew 5.2.3 fixes the missing backslash escaping in ClickHouse variable substitution. Versions prior to 5.2.3 are affected.