rootpwn

high · CVSS v3 8.8 · CVSS v4 6.5

CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c…

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist containing only seven SQL keywords. An authenticated user with AI feature access can submit dangerous statements or database functions that are absent from the read-only keyword blocklist, causing them to execute without SQL injection or keyword-obfuscation techniques. Depending on the database engine, configuration, and database-user privileges, this can expose or write files, access internal network resources, change database privileges, execute commands, or alter data. This issue is fixed in version 5.2.2.

Scores

Severity
high
CVSS v2
6.5
CVSS v3
8.8
CVSS v4
6.5
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-94144

A high‑severity SQL injection flaw exists in drogonframework’s ORM component, allowing remote attackers to inject arbitrary SQL via the makeCriteria function. The vulnerability is present in all drogon releases up to 1.9.13 and has been publicly exploited. Defenders should immediately update or patch the framework to mitigate the risk.

View analysis

high

CVE-2026-88406

FalkorDB Redis module versions 4.20.1 through 4.20.4 contain a stack overflow in the _ValidateUnion_Clauses function that can be triggered by crafted input. This flaw allows an attacker to cause a denial‑of‑service (DoS) by crashing the module. The vulnerability is limited to the FalkorDB module and does not expose data or allow remote code execution.

View analysis

high

CVE-2026-88407

FalkorDB, a Redis module, has an out-of-bounds read in the node_token_count/relation_token_count component. Versions 4.20.1 to 4.20.4 are affected. The flaw can lead to a denial of service when a crafted input is processed.

View analysis

high

CVE-2026-88410

The FalkorDB Redis module (v4.20.1‑v4.20.4) contains a bug where the graph.UDF command is not registered as a write command, causing unexpected application behavior. This flaw can lead to data integrity issues or denial of service within systems that rely on FalkorDB for graph operations. Defenders should be aware that any deployment of these specific module versions is potentially impacted.

View analysis