A flaw in the ClickHouse protocol handling within Chartbrew allows an attacker to supply a backslash immediately before a quotation mark in a variable value. Because the escapeBackslash option is not enabled, the backslash is removed before the string is interpolated, turning the quote into part of the SQL command. This omission creates a classic SQL injection vulnerability (CWE‑89) that permits an attacker to execute arbitrary ClickHouse SQL statements. Successful exploitation can leak sensitive database contents or, if the ClickHouse server allows, read files or explore internal network resources.

The vulnerability exists in the Chartbrew application, affecting any instance that has a version earlier than 5.2.3. No other vendors or product lines are reported to be affected.

The CVSS score of 7.9 reflects a high severity for a data‑exposure flaw. EPSS is not available and the issue is not listed in CISA’s KEV catalog. Public dashboards can be accessed without authentication, so the attack vector is unauthenticated remote access. An attacker would craft a malicious variable value in a dashboard that is served to visitors, causing the ClickHouse engine to execute the injected SQL.