Overview
CVE-2026-54349 is a critical (CVSS 9.8) SQL injection vulnerability in Chartbrew, an open-source web application that connects to databases and APIs to build charts and dashboards. It was published on November 6, 2026 and is fixed in version 5.2.1.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-54349 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-89 (SQL Injection) |
| Affected Software | Chartbrew before 5.2.1 |
| Fixed Version | 5.2.1 |
| Advisory | GHSA-4wj7-9gq7-mrr2 |
Vulnerability Details
Chartbrew's SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across its SQL connectors. Replacement patterns in the supplied value were interpreted rather than treated as literal text, which allowed query text to be altered. Separately, the code failed to escape backslashes in MySQL and MariaDB quoted contexts, a classic route to breaking out of a string literal.
Third-party analysis describes the attack as network-reachable and requiring no authentication. VulDB names applyMysqlOrPostgresVariables as the affected function.
Impact
- Reading or modifying data in the databases Chartbrew is connected to
- Exposure of Chartbrew's own application database, including stored connection credentials
- A pivot point into every backend data source configured in the instance
Exploitation Status
No public exploit code has been confirmed, and the CVE is not in CISA's KEV catalog at the time of writing.
Remediation
- Upgrade to Chartbrew 5.2.3 or later. This covers this CVE and the related session-token flaws (CVE-2026-85295 and CVE-2026-85708).
- Use read-only database accounts for Chartbrew connections wherever possible.
- Review database logs for unexpected queries originating from the Chartbrew service account.
- Rotate credentials stored in Chartbrew if you suspect exposure.