CVE-2026-85726

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description An issue exists in the way date-typed MongoDB variables are handled when placed inside quoted query placeholders. These variables are inserted as unescaped strings, whereas strings, numbers, and Booleans are safely escaped or coerced. This affects public, shareable, or embedded charts backed by MongoDB that use date-variable substitution. An unauthenticated user can provide a crafted URL filter to a reachable chart, allowing the date value to break out of the quoted literal and alter the query logic. This creates a Boolean oracle based on the returned row count, enabling the read-only extraction of any field within the queried collection, including sensitive data not displayed by the chart, on a character-by-character basis.

Recommendations Update to version 5.2.3.