SQL Injection Vulnerability in Chartbrew Web Application
CVE-2026-54349

9.8CRITICAL

Key Information:

Vendor

Chartbrew

Status
Chartbrew
Vendor
CVE Published:
6 November 2026

What is CVE-2026-54349?

Chartbrew, an open-source web application designed for creating data visualizations from databases and APIs, has a significant SQL injection vulnerability affecting versions prior to 5.2.1. The flaw arises from the unsafe handling of attacker-controlled JavaScript replacement strings through SQL dashboard-variable substitution. This vulnerability can be exploited by unauthenticated users who send crafted URL filter values to public or embedded chart requests backed by stored SQL queries. The consequences include unauthorized reading, modifying, or deleting of data accessible to the database account, as the injected SQL can bypass intended access controls. The issue has been promptly addressed in version 5.2.1.

Affected Version(s)

chartbrew < 5.2.1

References

https://github.com/chartbrew/chartbrew/security/advisorie...
x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/commit/f93d31ac586...
x_refsource_MISC
https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.