CVE-2026-65980

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls the applySqlVariables() function from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. In charts backed by ClickHouse that use variable binding, an attacker can provide a backslash before a quote, preventing quote doubling from keeping the value within its intended SQL string literal. Public dashboards may expose this path without authentication, allowing the execution of arbitrary ClickHouse SQL to disclose data or, depending on database configuration, access internal network resources and files.

Recommendations Update to version 5.2.3.