Chartbrew’s ChartDatasetConfig.legend field can store arbitrary HTML or JavaScript that is persisted exactly as entered. When the chart renders, the stored value is injected into the tooltip element via an unguarded innerHTML assignment, allowing malicious script to execute as soon as the page loads. Because the echo of the payload occurs in the public dashboard, any user—authenticated or not—who visits the chart will trigger the injected code. The vulnerability is a classic stored DOM cross‑site scripting flaw (CWE‑79) that can steal session cookies, deface the site, or perform credential phishing against the viewer’s browser.

Chartbrew, the open‑source analytics platform. Versions 4.9.0 through 5.0.0 are affected; version 5.0.1 and later contain a fix for this flaw.

The CVSS score of 7.6 labels it as high severity. The EPSS score is not available, so the exploitation probability is unknown, but the flaw is not listed in the CISA KEV catalog. An attacker needs an account with project‑editor permissions to inject the payload; however, once injected, any unauthenticated observer of the public chart will experience JavaScript execution immediately, without even hovering over the chart. The lack of an authentication precondition for the second step amplifies the risk to all users of the public dashboard.