---
id: "CVE-2026-54349"
page: "https://infrastack.ai/live/CVE-2026-54349"
kind: "vulnerability"
aliases: ["CVE-2026-54349"]
title: "Chartbrew: unauthenticated SQL injection via public chart URL filters"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chartbrew", "mariadb", "mysql", "package", "postgresql", "self-hosted", "sql"]
not_affected_if: ["auth-required", "no-embedded-charts", "no-public-charts", "static-variables"]
published_at: "2026-11-06T21:17:08+00:00"
first_seen_at: "2026-11-06T21:45:07+00:00"
updated_at: "2026-11-06T21:46:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54349", "first_seen_at": "2026-11-06T21:45:07+00:00"}]
exploit_sources: []
---

# Chartbrew: unauthenticated SQL injection via public chart URL filters

Link for people: https://infrastack.ai/live/CVE-2026-54349 (this .md is for agents)

Chartbrew, a web app that builds charts from databases and APIs, mishandles URL filter values in SQL dashboard variables before version 5.2.1. An unauthenticated visitor to a public or embedded chart can inject SQL and read, modify, or delete data the configured database account can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chartbrew version and confirm whether it is below `5.2.1`.
- Look for public or embedded dashboards and charts whose stored SQL query uses dashboard variables filled from URL parameters.

## Fix

- Upgrade Chartbrew to `5.2.1` or later.

## Timeline

- 2026-11-06T21:45:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54349

## Documents

- [advisory] Vendor advisory: github.com https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2
- [fix] Patch: github.com https://github.com/chartbrew/chartbrew/commit/f93d31ac586091f72a7eb97d89fa3b4db271bd24
- [fix] Release notes: github.com https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1

## From the sources

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_