Chartbrew's AI runQuery tool enforces a read‑only policy by filtering SQL statements against a short list of prohibited keywords. The blocklist contains only seven keywords, omitting many dangerous statements and functions such as DROP, EXEC, REVOKE, and sysadmin commands. An authenticated user with AI feature access can submit queries containing these missing tokens, which the tool then executes without any safeguard, leading to unintended data disclosure, modification, or even execution of system commands depending on the underlying database permissions.

Any deployment of the open‑source Chartbrew web application before version 5.2.2 is affected. The vulnerability resides in the runQuery.js module within the advanced AI orchestrator component and impacts all database connections that the application can reach. Users of the standard Chartbrew instance can exploit it if they have AI feature privileges. Version 5.2.2 and later contain a fixed blocklist that blocks the dangerous keywords, thereby removing the flaw.

The CVSS score of 6.5 indicates moderate severity, and because EPSS data is unavailable there is no current evidence of widespread exploitation. The vulnerability is not listed in CISA KEV, and the attack requires an authenticated user with AI access, but once such a user crafts a malicious query the system can read, write, or alter data and potentially execute arbitrary commands if database privileges allow. The risk is therefore significant for installations that grant AI feature rights to broad user groups or expose the application to untrusted networks.