CVE-2026-54349

Summary

Chartbrew prior to 5.2.1 allows unauthenticated SQL injection via unsanitized URL-controlled variables in dashboard/chart queries, where attacker-supplied JavaScript replacement strings bypass intended escaping and alter SQL logic independently of the database engine, with a secondary backslash-escape flaw in MySQL/MariaDB contexts enabling further injection.

Exploitability

Exploitation is straightforward for unauthenticated attackers targeting public or embedded charts that use URL variables in stored SQL queries; no authentication or special privileges required.

Blast radius

Successful exploitation enables full compromise of the database accessible to the application’s database account, including data exfiltration, modification, or deletion.

Detection

Look for SQL syntax anomalies in application logs for requests to public/embedded chart endpoints with URL filter parameters containing dollar-sign sequences (e.g., $${...}) or unexpected backslash patterns in SQL query contexts; however, no reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Chartbrew version 5.2.1 or later, which fixes both the unsafe variable substitution and the MySQL/MariaDB backslash-escape handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.