Chartbrew, an open-source analytics platform, contains a remote code execution flaw discovered in its API. The flaw permits an attacker to inject and execute arbitrary code via the vulnerable endpoint, exposing the server to complete compromise of confidentiality, integrity, and availability. The weakness maps to CWE‑94, an issue involving unsanitized code execution.

The vulnerability affects all deployments of Chartbrew prior to version 4.8.1. Installations using any version older than 4.8.1 are susceptible and should be updated as soon as possible.

The CVSS v3.1 score of 8.8 marks this a high‑risk vulnerability. EPSS indicates the exploitation probability is less than 1%, but the flaw is publicly disclosed and may be used by adversaries with the appropriate API credentials. Chartbrew is not yet listed in the CISA KEV catalog, though the lack of listing does not mitigate the need for immediate action. The likely attack vector is via crafted API calls that accept code payloads, so any exposed API endpoint without proper authentication or input validation can be exploited.