CVE-2026-54349 · Package
NO FIX YET · SEE WHAT TO DO
Chartbrew, a web app that builds charts from databases and APIs, mishandles URL filter values in SQL dashboard variables before version 5.2.1. An unauthenticated visitor to a public or embedded chart can inject SQL and read, modify, or delete data the configured database account can reach.
first public Jul 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Chartbrew and expose public or embedded charts whose SQL queries use URL-controlled dashboard variables are exposed. Instances with no public or embedded charts, or with only hard-coded query variables, are not affected by the described path. Only the MySQL and MariaDB backslash branch is specific to those databases; the replacement-string flaw applies across SQL connectors.
Not affected if auth-required, no-embedded-charts, no-public-charts, static-variables
Who cares chartbrew, mariadb, mysql, postgresql, self-hosted, sql
5.2.1.5.2.1 or later.Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.