CVE-2026-27005
Published: 06 March 2026
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew…
more
(MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection attacks by requiring validation and sanitization of user inputs used in database queries.
Requires timely remediation of flaws like this SQL injection vulnerability through patching to version 4.8.3 or equivalent.
Limits the impact of successful SQL injection by enforcing least privilege on the database user accounts used by Chartbrew.
Security SummaryAI
CVE-2026-27005 is a SQL injection vulnerability (CWE-89) affecting Chartbrew, an open-source web application designed to connect directly to databases and APIs for creating charts from data. Versions of Chartbrew prior to 4.8.3 are vulnerable, specifically when connected to MySQL or PostgreSQL databases, as the application fails to properly sanitize user inputs in SQL queries executed against these backends.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By injecting arbitrary SQL into queries, the attacker can read, modify, or delete data in the connected databases, with the extent of impact determined by the privileges of the database user account configured in Chartbrew.
The issue has been addressed in Chartbrew version 4.8.3, which patches the SQL injection flaw. Official advisories and release notes are available on the Chartbrew GitHub repository, including the security advisory at GHSA-w5rh-v333-qq6c and the release tag for v4.8.3.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (Chartbrew) enables exploitation of public-facing application (T1190) and facilitates arbitrary data access from databases (T1213.006).