Chartbrew is an open‑source web application that allows users to fetch data from databases and APIs to build charts. A flaw in the MongoDB dataset query handling allowed an attacker to inject arbitrary code that would be executed on the application server. This is a code injection vulnerability, classified as CWE‑94, and could lead to full compromise of the host running the service.

Versions of Chartbrew prior to 4.8.1 are affected. The fix was released in the 4.8.1 release and all later builds contain the patch. Any deployment using an older build must be upgraded.

The vulnerability has a high severity rating, with a calculated score of 7.2. The estimated probability that it is currently being exploited is very low, less than one percent, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote, achievable through the web API or dashboard that processes user-supplied MongoDB queries, requiring network access to the Chartbrew instance and the ability to craft a malicious query.