CVE-2026-54349

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.1

Description An unauthenticated user can perform SQL injection via public or embedded dashboard and chart requests that utilize the applyMysqlOrPostgresVariables function. The issue occurs because SQL dashboard-variable substitution unsafely handles attacker-controlled JavaScript replacement strings across SQL connectors and fails to escape backslashes in quoted contexts for MySQL and MariaDB. By sending crafted URL filter values to a chart backed by a stored SQL query, an attacker can use replacement-string dollar sequences or backslash handling to alter SQL queries. This allows the attacker to read, modify, or delete data accessible to the configured database account.

Recommendations Update to version 5.2.1.