CVE-2026-85726: Chartbrew: Blind NoSQL injection via date variable in embedded chart
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, a date-typed MongoDB variable placed inside a quoted query placeholder was inserted as an unescaped string, unlike the safely escaped or coerced string, number, and Boolean branches. The vulnerable surface is mongoDB-backed public, shareable, or embedded charts processed by date-variable substitution. An unauthenticated user supplies a crafted URL filter to a public, shareable, or embedded MongoDB chart whose query places a date-typed variable in a quoted literal. The crafted date value breaks out of the quoted literal and changes query logic; the chart's returned row count becomes a Boolean oracle for character-by-character field extraction. The chart must be externally reachable and use the vulnerable date-in-quoted-placeholder branch. Extraction is read-only and limited to one queried collection per request, and it requires neither an account nor a known field value. The blind oracle can disclose any field in the queried collection, including secrets the chart does not display. This issue is fixed in version 5.2.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
Which Chartbrew deployments are exposed?
Exposure requires a MongoDB-backed chart that is public, shareable, or embedded and externally reachable. Its query must place a date-typed variable inside a quoted placeholder; charts that do not use this specific substitution path are not described as affected.
What does an attacker need to exploit this issue?
An attacker needs only network access to a reachable affected chart and the ability to provide a crafted URL filter. No account, prior knowledge of a field value, or write access is required.
What data could be disclosed?
The blind row-count oracle can be used to extract any field in the collection queried by the affected chart, including fields not displayed by the chart and potentially secrets. The described extraction is read-only and limited to one queried collection per request.
What can be done if upgrading is not immediately possible?
Remove external access to affected public, shareable, and embedded MongoDB charts, or prevent them from accepting the vulnerable date-variable-in-quoted-placeholder query pattern. Prioritize charts whose queried collections contain sensitive fields, including fields not rendered in the chart.
How can I identify potentially affected charts?
Review externally reachable MongoDB-backed public, shareable, and embedded charts for queries that use a date-typed variable within a quoted query placeholder. Version 5.2.3 contains the fix, so installations prior to that version should be assessed for this pattern.