CVE-2026-41518: Chartbrew Stored XSS in Chart Legend (Versions 4.9.0–5.0.0)

Technical summary

The vulnerability stems from improper sanitization in the Chart.js tooltip rendering pipeline. Specifically, the `ChartTooltip.js` component uses an unguarded `innerHTML` assignment to populate tooltip DOM elements with content sourced from the `ChartDatasetConfig.legend` field. An authenticated user with project-editor permissions can store arbitrary HTML and JavaScript payloads in this field; the payload persists in the database and is injected verbatim into the tooltip DOM on page render. Verification testing demonstrates that JavaScript executes immediately upon dashboard load for all viewers, regardless of authentication status or user interaction.

Business impact

Organizations using Chartbrew to share public dashboards face significant risk. Attackers with project-editor access can compromise dashboard viewers' browsers, enabling credential theft, malware injection, or unauthorized API calls to backend systems connected to the Chartbrew instance. Since execution occurs on page load for unauthenticated users, any individual with the public dashboard URL is vulnerable. For organizations sharing dashboards with external partners or customers, the reputational and legal implications of a compromise could be severe.

Affected systems

Chartbrew versions 4.9.0 through 5.0.0 are affected. The vulnerability requires an authenticated user with project-editor permissions to introduce the payload, meaning internal users, contractors, or compromised accounts with editor access pose the primary threat vector. Version 5.0.1 and later contain the remediation.

Exploitability

The attack is relatively straightforward to execute: an attacker with project-editor privileges inputs a malicious script into the legend field and saves the configuration. No user interaction is needed; the payload fires automatically when any viewer loads the dashboard. The low complexity, lack of user interaction requirement, and network-accessible nature of public dashboards make this vulnerability moderately easy to weaponize in real-world scenarios. However, the prerequisite of project-editor access (or account compromise) provides a partial control boundary.

Remediation

Upgrade to Chartbrew version 5.0.1 or later, which includes fixes to sanitize legend field input and prevents innerHTML injection. If immediate patching is not feasible, restrict project-editor role assignments to trusted users only, limit public dashboard sharing, and review dashboard access logs for suspicious modifications to chart configurations.

Patch guidance

Apply version 5.0.1 or any later release through your package manager or by rebuilding from the updated source repository. Verify the patch is deployed by confirming the version string in the application UI and reviewing the Chart.js tooltip rendering code to ensure innerHTML is no longer used for untrusted input. Test public dashboard functionality after patching to confirm charts render correctly.

Detection guidance

Examine the `ChartDatasetConfig.legend` field in your Chartbrew database for HTML tags, script elements, or event handler attributes (e.g., `onerror=`, `onclick=`). Review access logs for project-editor role assignments and recent modifications to chart configurations by unexpected users. Monitor for JavaScript console errors or unusual network requests originating from dashboard viewers' browsers. If using a web application firewall or content security policy, log and alert on inline script execution attempts within dashboard contexts.

Why prioritize this

This vulnerability merits prompt attention because it enables cross-site scripting attacks against all public dashboard viewers without requiring user interaction. The HIGH CVSS score (7.6) reflects the high confidentiality impact, cross-site scope, and relatively easy exploitation path for authorized users. While not in CISA's KEV catalog, the combination of low barriers to execution and potential for widespread impact across dashboard audiences warrants prioritization within your patching schedule—particularly if your organization hosts or shares Chartbrew dashboards with external parties.

Risk score, explained

The CVSS 3.1 score of 7.6 (HIGH) is driven by: high confidentiality impact (user sessions, data in page context), low integrity impact (ability to modify displayed content or inject redirects), no availability impact, network-accessible attack vector, low attack complexity, and requirement for prior authentication with project-editor role. The cross-site scope multiplier elevates the severity because attacks propagate to unauthenticated viewers beyond the application boundary. However, the authenticated prerequisite prevents a 'Critical' rating.

Frequently asked questions