{"metadata": {"vulnerability": "CVE-2026-54349", "count": 14, "kinds": {"milestone": 3, "sighting": 5, "kev": 0, "other": 6}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-12T19:23:22.317Z", "date_only": false, "value": "2026-06-12T19:23:22.317Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-54349", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T21:04:39.792Z", "date_only": false, "value": "2026-11-06T21:04:39.792Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54349", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-06T21:04:39.792Z", "date_only": false, "value": "2026-11-06T21:04:39.792Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-54349", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T21:16:17.500Z", "date_only": false, "value": "2026-11-06T21:16:17.500334Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117571569387806397", "record": "CVE-2026-54349", "field": "creation_timestamp", "uuid": "58c3c6f9-b266-4920-a256-62366ead06c2", "content": "CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-54349https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2https://github.com/chartbrew/chartbrew/commit/f93d31ac586091f72a7eb97d89fa3b4db271bd24https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1#chartbrew#CVE_2026_54349#bot", "url": "https://infosec.exchange/users/cve/statuses/117571569387806397"}, {"timestamp": "2026-11-06T21:17:08.947Z", "date_only": false, "value": "2026-11-06T21:17:08.947", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54349", "record": "FKIE_CVE-2026-54349", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T22:07:51.546Z", "date_only": false, "value": "2026-11-06T22:07:51.546246Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzoffxfkno2n", "record": "CVE-2026-54349", "field": "creation_timestamp", "uuid": "87d5f134-5fea-4f92-92bb-aa80074ee3e4", "content": "\ud83d\udea8 CVE-2026-54349 \u2014 CVSS 9.8 CRITICAL\n\nChartbrew is an open-source web application that can connect directly to databases and APIs and use the dat...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-54349\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzoffxfkno2n"}, {"timestamp": "2026-11-07T01:02:26.733Z", "date_only": false, "value": "2026-11-07T01:02:26.733061Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzop64xilb2h", "record": "CVE-2026-54349", "field": "creation_timestamp", "uuid": "03709003-a7d4-4027-b88b-6ba581bac690", "content": "\ud83d\udd34 CVE-2026-54349 - Critical (9.8)\n\nChartbrew is an open-source web application that can connect directly to databases and APIs and u...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54349/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzop64xilb2h"}, {"timestamp": "2026-11-07T01:40:03.188Z", "date_only": false, "value": "2026-11-07T01:40:03.188352Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzorbf54lk2q", "record": "CVE-2026-54349", "field": "creation_timestamp", "uuid": "833f8a43-d822-479f-b165-4cb0d3436712", "content": "CVE-2026-54349 - chartbrew\nChartbrew versions before 5.2.1 let anyone craft a URL that changes the SQL query used for a public or embedded chart. By inserting special characters, an attacker can read, change or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#chartbrew #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzorbf54lk2q"}, {"timestamp": "2026-11-09T13:26:02.804Z", "date_only": false, "value": "2026-11-09T13:26:02.804102Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54349", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T13:26:02.804Z", "date_only": false, "value": "2026-11-09T13:26:02.804102Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54349", "record": "FKIE_CVE-2026-54349", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-09T13:26:42.474Z", "date_only": false, "value": "2026-11-09T13:26:42.474Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-54349", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T13:26:42.474Z", "date_only": false, "value": "2026-11-09T13:26:42.474Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54349", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T14:17:21.623Z", "date_only": false, "value": "2026-11-09T14:17:21.623", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54349", "record": "FKIE_CVE-2026-54349", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-09T14:50:13.906Z", "date_only": false, "value": "2026-11-09T14:50:13.906716Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mzv6e3zshc2b", "record": "CVE-2026-54349", "field": "creation_timestamp", "uuid": "3fa5e6ac-b35c-4bbf-a5d9-adf48d9e45d6", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-54349: Chartbrew SQL injection in dashboard filter substitution\nCVSS 9.8 \u00b7 EPSS 0.4%\nhttps://vulnsea.com/cve/CVE-2026-54349\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mzv6e3zshc2b"}], "metrics": {"as_of": "2026-11-13T06:23:16.147Z", "anchors": {"origin": {"timestamp": "2026-11-06T21:04:39.792Z", "date_only": false, "value": "2026-11-06T21:04:39.792Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54349", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-06T21:04:39.792Z", "date_only": false, "value": "2026-11-06T21:04:39.792Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54349", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 551916.355108, "hours": 153.3100986411111, "days": 6.387920776712963, "min_seconds": 551916.355108, "max_seconds": 551916.355108, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-06T21:04:39.792Z", "date_only": false, "value": "2026-11-06T21:04:39.792Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54349", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T06:23:16.147Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}