Chartbrew’s safeRequest.js validates outbound URLs by resolving a target hostname, but the underlying request-promise library performs a separate DNS resolution when establishing the connection. A user authenticated with permissions to create or test API connections can supply a DNS name that resolves to a public address during validation and to a private address or internal host during the actual request. This DNS rebinding bypass defeats the outboundTargetPolicy checks and allows the attacker to access internal services, localhost resources, or cloud metadata endpoints. The vulnerability effectively provides a Server‑Side Request Forgery that can expose sensitive internal infrastructure.

All installations of Chartbrew older than version 5.2.2 are affected. The issue was discovered in the safeRequest.js and outboundTargetPolicy.js modules and has been addressed in release v5.2.2. The product is an open‑source web application that can connect directly to databases and APIs to generate charts; users with the ability to create API connections possess the necessary privilege to exploit the flaw.

The CVSS score of 6.3 indicates a medium severity. The EPSS score is not posted, and the vulnerability has not yet appeared in the CISA KEV catalog. Exploitation requires user authentication and permissions to create API connections, which limits the attack surface to privileged users. Because internal hosts are only reached after initial verification, the risk is moderate; however, once the flaw is activated, the attacker can read or rewrite internal data or interact with cloud metadata, potentially serving as a foothold for further lateral movement.