---
id: CVE-2026-54349
title: Chartbrew SQL injection in dashboard filter substitution
summary: >-
  Chartbrew is an open-source web application that can connect directly to
  databases and APIs and use the data to create charts. Prior to 5.2.1, SQL
  dashboard-variable substitution used attacker-controlled JavaScript
  replacement strings un…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-89
vendor: chartbrew
product: chartbrew
affected:
  - chartbrew < 5.2.1
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T21:04:39.792Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54349'
references:
  - url: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2
    label: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2
  - url: >-
      https://github.com/chartbrew/chartbrew/commit/f93d31ac586091f72a7eb97d89fa3b4db271bd24
    label: >-
      https://github.com/chartbrew/chartbrew/commit/f93d31ac586091f72a7eb97d89fa3b4db271bd24
  - url: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1'
    label: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1'
tags:
  - cve.org
ingestedAt: '2026-11-06T22:04:56.334Z'
epss: 0.00426
epssPercentile: 0.37113
---

## Overview

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.

## Affected

- `chartbrew < 5.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.