CVE-2026-41518: Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)

Synopsis

Stored cross-site scripting (XSS) via an unguarded innerHTML assignment affects Chartbrew versions 4.9.0 through 5.0.0. An authenticated user with project-editor permissions can inject arbitrary HTML or JavaScript into the ChartDatasetConfig.legend field; the payload persists in the database and is written directly into the tooltip DOM element when any visitor loads a public dashboard, with no hover or click required. Successful exploitation gives the attacker arbitrary JavaScript execution in the victim's browser session, enabling session-token theft, DOM manipulation, and data exfiltration. HarborGuard tracks this advisory and will make a patched-image rebuild available for affected environments once a fix version is confirmed upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Chartbrew application over the network to submit the malicious legend payload, and victims must be able to load the public dashboard over the network to trigger execution.

• AuthenticationRequired

  The attacker needs at minimum a low-privilege project-editor account to write the payload into the ChartDatasetConfig.legend field; unauthenticated parties cannot submit the payload, though they are the victims who trigger execution.

• Victim interactionRequired

  A victim must load the public dashboard page in their browser; while no click or hover is needed, a page visit is required to trigger the injected JavaScript.

• Attack complexityDetail

  The exploit is reliable and condition-free once the payload is stored: no race conditions, memory layout dependencies, or environmental factors are required for successful execution.

Blast Radius

• Reads session tokens, authentication cookies, and any credentials stored in the victim's browser context for the Chartbrew origin.
• Exfiltrates sensitive data visible in the DOM, including chart data and any personally identifiable information rendered on the dashboard.
• Performs actions on behalf of the victim within the Chartbrew application, such as modifying project settings or creating further malicious payloads.
• Delivers secondary payloads, for example redirecting victims to attacker-controlled pages or installing browser-based malware.