Platform
nodejs
Component
chartbrew
Fixed in
4.8.2
CVE-2026-25888 describes a Remote Code Execution (RCE) vulnerability discovered in Chartbrew, an open-source data visualization tool. This flaw allows attackers to execute arbitrary code through a vulnerable API endpoint. Versions of Chartbrew prior to 4.8.1 are affected, and a patch has been released in version 4.8.1 to address the issue.
The RCE vulnerability in Chartbrew poses a significant threat. An attacker exploiting this flaw could gain complete control over the server hosting the Chartbrew application. This includes the ability to read, modify, and delete sensitive data stored within the database or accessible through connected APIs. Lateral movement within the network is also possible if the server has access to other systems. The blast radius extends to any data processed and visualized by Chartbrew, potentially impacting business-critical information and sensitive user data.
CVE-2026-25888 was publicly disclosed on 2026-03-06. Currently, there are no known public exploits or active campaigns targeting this vulnerability. The vulnerability is not listed on the CISA KEV catalog as of this writing. The availability of a patch significantly reduces the likelihood of exploitation.
Exploit Status
EPSS
0.32% (55% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-25888 is to immediately upgrade Chartbrew to version 4.8.1 or later. If upgrading is not immediately feasible due to compatibility concerns or downtime constraints, consider implementing temporary workarounds. These may include restricting access to the vulnerable API endpoint using a Web Application Firewall (WAF) or proxy server, and carefully reviewing and validating all API inputs to prevent malicious code injection. Monitor Chartbrew logs for any suspicious activity related to API calls.
Actualice Chartbrew a la versión 4.8.1 o superior. Esta versión contiene una corrección para la vulnerabilidad de ejecución remota de código. Puede descargar la última versión desde el sitio web oficial o a través del gestor de paquetes correspondiente.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-25888 is a Remote Code Execution vulnerability in Chartbrew versions prior to 4.8.1, allowing attackers to execute arbitrary code via a vulnerable API.
Yes, if you are running Chartbrew version 4.8.1 or earlier, you are vulnerable to this RCE flaw.
Upgrade Chartbrew to version 4.8.1 or later to patch the vulnerability. Consider temporary WAF rules if immediate upgrade is not possible.
As of now, there are no confirmed reports of active exploitation, but vigilance is still advised.
Refer to the Chartbrew project's official website or GitHub repository for the latest security advisories and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.