What is the CVSS score of CVE-2026-25887?

CVE-2026-25887 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MongoDB are affected by CVE-2026-25887?

Chartbrew versions prior to 4.8.1 contain a remote code execution vulnerability that could allow attackers to execute arbitrary code on systems running this data visualization platform.

Is there a public PoC exploit available for CVE-2026-25887?

Yes, a public proof-of-concept exploit is available for CVE-2026-25887. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-25887?

Within 24 hours: Inventory all Chartbrew instances and document which versions are deployed; immediately disable MongoDB dataset query functionality if feasible or restrict network access to the application. Within 7 days: Implement network segmentation to limit Chartbrew's access to databases and APIs; monitor for suspicious query patterns and code execution attempts. Within 30 days: Upgrade to Chartbrew 4.8.1 or later once available; conduct a security audit of affected systems for signs of exploitation.

MongoDB CVE-2026-25887

HIGH

Code Injection (CWE-94)

2026-03-06 security-advisories@github.com

RCE MongoDB Chartbrew Depomo

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 14:07 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 05:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via the MongoDB dataset Query. This issue has been patched in version 4.8.1.

AnalysisAI

Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execute arbitrary code through malicious MongoDB dataset queries. The vulnerability affects users connecting Chartbrew to MongoDB databases for chart creation and has active public exploit code available. No patch is currently available for affected versions.

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects Chartbrew. Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via the MongoDB dataset Query. This issue has been patched in version 4.8.1.