Advisories · Technology
chartbrew.
Every CVE that names chartbrew among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.9 High
Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution
- chartbrew
- SQL injection
- CVSS 6.5 Medium
Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool
- chartbrew
- CWE-184
- CVSS 5.8 Medium
Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool
- chartbrew
- SQL injection
- CVSS 6.3 Medium
Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation
- chartbrew
- CWE-350
- CVSS 7.6 High
Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)
- chartbrew
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override
- chartbrew
- Broken access control
- CVSS 7.5 High
Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle
- chartbrew
- Broken access control
- CVSS 8.1 High
Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id
- chartbrew
- Broken access control
- CVSS 7.5 High
Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks
- chartbrew
- Broken access control
- CVSS 6.5 Medium
Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew
- chartbrew
- Authentication bypass
- CVSS 8.1 High
Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks
- chartbrew
- Broken access control
- CVSS 7.7 High
Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
- chartbrew
- Broken access control
- CVSS 7.8 High
Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- chartbrew
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API
- chartbrew
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 8.7 High
Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions
- chartbrew
- Authentication bypass
- CVSS 8.8 High
Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)
- chartbrew
- SQL injection
- CVSS 8.8 High
Chartbrew: Remote Code Execution (RCE) via Vulnerable API
- chartbrew
- Code injection
- CVSS 7.2 High
Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
- chartbrew
- Code injection
- CVSS 6.5 Medium
Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations
- chartbrew
- Broken access control