CVE-2026-85726 · Package
NO FIX YET · SEE WHAT TO DO
Chartbrew is a web app that builds charts from databases and APIs. Before 5.2.3, a date variable placed inside a quoted MongoDB query was not escaped, so an unauthenticated visitor to a public, shareable or embedded chart can use a crafted URL filter to read any field in the queried collection, one character at a time.
first public Sep 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run Chartbrew with MongoDB data sources and expose charts publicly, as a shareable link or in an embed. The flaw needs a chart that is reachable from the internet and uses a date variable inside a quoted query placeholder; Chartbrew instances with no public charts or without MongoDB sources are not described as exposed.
Not affected if no-mongodb-source, no-public-charts, version-5.2.3-or-later
Who cares chartbrew, mongodb, self-hosted
5.2.3.5.2.3.Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, a date-typed MongoDB variable placed inside a quoted query placeholder was inserted as an unescaped string, unlike the safely escaped or coerced string, number, and Boolean branches. The vulnerable surface is mongoDB-backed public, shareable, or embedded charts processed by date-variable substitution. An unauthenticated user supplies a crafted URL filter to a public, shareable, or embedded MongoDB chart whose query places a date-typed variable in a quoted literal. The crafted date value breaks out of the quoted literal and changes query logic; the chart's returned row count becomes a Boolean oracle for character-by-character field extraction. The chart must be externally reachable and use the vulnerable date-in-quoted-placeholder branch. Extraction is read-only and limited to one queried collection per request, and it requires neither an account nor a known field value. The blind oracle can disclose any field in the queried collection, including secrets the chart does not display. This issue is fixed in version 5.2.3.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.