PT-2026-46317 · Chartbrew · Chartbrew

Qiaonpc · CVE-2026-41518 · Published 2026-06-04 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions 4.9.0 through 5.0.0

Description An authenticated user with project-editor permissions can store arbitrary HTML and JavaScript in the ChartDatasetConfig.legend field. This payload is saved in the database and injected into the tooltip DOM element through an unguarded innerHTML assignment in the ChartTooltip.js file. Consequently, any unauthenticated viewer of a public dashboard will trigger the execution of the JavaScript on page load without requiring any interaction. This is a Stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the target server and served to other users.

Recommendations Update to version 5.0.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41518

GHSA-6Q2J-365C-7GQF

Affected Products

Chartbrew

References · 5

• 🔥 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6q2j-365c-7gqf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41518.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-41518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41518 · Security Note
• https://twitter.com/VulmonFeeds/status/2062681575083381230 · Twitter Post